CVE-2024-14047 is a high severity (CVSS 7.2) link following flaw in the Winlogbeat Windows MSI installer. Runtime files sat in a directory that low-privileged users could write to. Elastic says all versions from 7.6.0 through 8.12.2 are affected and the issue is resolved in 8.13.0.
What's affected
Per Elastic security announcement ESA-2024-49:
- Affected versions: all versions from 7.6.0 up to and including 8.12.2.
- Affected configurations: only Windows installations using the MSI installer.
- Fixed version: 8.13.0.
- Workarounds: Elastic says there are none for users who cannot upgrade.
- Indicators of compromise: none identified.
The CVSS vector is local (AV:L), needs low privileges and user interaction, and has a changed scope. That fits the description of a local attacker preparing links before an elevated Winlogbeat operation runs.
How to check if you're exposed
On each Windows host that ships logs with Winlogbeat, open a command prompt in the install directory and print the version:
winlogbeat.exe version
Anything from 7.6.0 through 8.12.2 that was installed with the MSI is affected. Hosts where Winlogbeat was unpacked from a zip archive are outside the stated configuration, but still worth bringing up to date.
Your software inventory or endpoint management tool can list MSI installs of Winlogbeat across the fleet faster than visiting each machine.
What to do now
- List every Windows host running Winlogbeat and record the version and install method.
- Upgrade MSI installs to 8.13.0 or later.
- Check the install directory permissions on hosts you cannot upgrade yet. Runtime files should not live in a location that unprivileged users can write to.
- Limit who has interactive or remote logon rights on hosts that run Winlogbeat.
- Keep the inventory so the next beats advisory is a quick lookup.
Why it matters
The class is CWE-59, improper link resolution before file access. A privileged process follows a symbolic link or similar filesystem link that a lower-privileged user placed in a shared location. The privileged process then writes to or deletes a file the attacker picked.
The advisory describes the outcome as arbitrary file write or delete leading to denial of service. It needs a foothold on the machine first, so the risk is mostly about shared or multi-user Windows servers, jump hosts and workstations where several people have accounts. On single-purpose servers with few logons the practical risk is lower, but the upgrade is simple.
A practical way to reduce this class of problem is to treat agent software like any other privileged service. Install it to a protected path, run it under a dedicated account, and review who can log on to the host. Those habits also limit the damage from future local flaws in other agents.
Quick check
Do zip installs of Winlogbeat have this problem?
Elastic limits the affected configuration to Windows installs that used the MSI installer. Still upgrade them to stay current.
Sources
Last reviewed: 19 October 2026.
