Tuesday, 31 March, 2026
Critical Zero-Day in Elastic EDR: Signed Kernel Driver Can Be Weaponized for RCE
By Isha
Ashes Cybersecurity disclosed a zero-day in Elastic’s kernel driver elastic-endpoint-driver.sys (CWE-476 NULL-pointer dereference) that lets attackers bypass EDR, achieve remote code execution, install a persistent malicious driver, and repeatedly trigger BSODs. The researcher produced a reliable PoC against version 8.17.6 and reported it via HackerOne and ZDI; no patch is available yet. Organisations should monitor kernels and apply mitigations promptly now.
Read full story at Cybersecurity News