CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Elastic denies RCE zero-day in Defend EDR

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Elastic has rejected claims of a zero-day remote code execution (RCE) vulnerability in its Defend endpoint detection and response (EDR) product. AshES Cybersecurity alleged a flaw in the 'elastic-endpoint-driver.sys' kernel driver that could bypass EDR monitoring and enable RCE. Elastic conducted an investigation and found no evidence to support the claims. AshES Cybersecurity published a blog post and videos demonstrating the alleged flaw, but Elastic could not reproduce the vulnerability. The company criticized AshES for not following coordinated disclosure principles and not providing reproducible exploits.

Timeline

  1. 19.08.2025 19:41 1 articles · 1mo ago

    Elastic denies zero-day RCE vulnerability in Defend EDR

    Elastic rejected claims of a zero-day remote code execution (RCE) vulnerability in its Defend EDR product. AshES Cybersecurity alleged a flaw in the 'elastic-endpoint-driver.sys' kernel driver that could bypass EDR monitoring and enable RCE. Elastic conducted an investigation and found no evidence to support the claims. AshES did not follow coordinated disclosure principles and did not provide reproducible exploits or full details of the vulnerability.

    Show sources
    Open in new tab

Information Snippets