An uncontrolled search path vulnerability in Elastic APM Server allows local attackers to elevate privileges to SYSTEM, posing a significant risk to affected Windows hosts.

The vulnerability involves an uncontrolled search path element, specifically CWE-427, which stems from improper directory permission handling. An authenticated local attacker can leverage this flaw to manipulate arbitrary files, leading to a full system privilege escalation.

The ability for a local user to escalate privileges to SYSTEM status represents a critical security failure, as it grants an attacker complete control over the host machine. Given the CVSS score of 7.0, this vulnerability carries a high risk of total system compromise, potentially leading to unauthorized data access, persistence establishment, and lateral movement within the enterprise network.

Immediate Action: Administrators should review the official Elastic security advisory (ESA-2025-12) and apply the necessary software updates as soon as they become available for their specific environment.

Proactive Monitoring: Monitor system logs for unusual file operations or unauthorized attempts to modify directory permissions, particularly within the installation paths for Elastic services.

Compensating Controls: Restrict local user access to the server and ensure that directory permissions are strictly hardened to prevent non-privileged users from modifying files within the application's search path.

Public Exploit Available: Unknown

This vulnerability presents a high risk for environments where local users may have unauthorized access to the system. Security teams should prioritize patching affected Elastic APM Server instances and ensure that least privilege principles are applied to directory structures to prevent similar exploitation vectors.