LocalSystem privilege escalation through rollback feature

Privilege escalation in Elastic Endpoint Security 8.4.0 allows local users to gain LocalSystem privileges through the Windows rollback feature. Elastic has not published the specific rollback operation or validation failure that permits the privilege transition. Exploitation requires a low-privileged local user and the Platinum or Enterprise self-healing rollback option, which is disabled by default; successful exploitation grants LocalSystem control.