CVE-2026-78594: Microsoft APM memory-exhaustion DoS

CISO Take

An authenticated user with write access to APM Server's source map storage can upload a specially crafted, highly compressed file that exhausts server memory the moment it's processed, crashing the process outright. This isn't a remote, unauthenticated exploit — CVSS 4.9 reflects the high privilege bar (PR:H) required — but the persistence mechanism is what makes it operationally painful: the malicious artifact stays in storage, so the server crashes again on every restart until someone manually finds and deletes it, turning a single bad upload into a recurring outage. There's no CISA KEV listing, no EPSS data, and no public exploit or scanner template, so opportunistic exploitation is unlikely; the realistic threat is an insider or a compromised CI/CD credential with source-map write access. Downstream package exposure is minimal (0 tracked dependents), but for any team running APM Server to monitor AI/LLM service latency and health, this is a monitoring blind-spot risk, not a data-loss one. Action: patch to the versions in Elastic's advisory (8.19.20 / 9.4.5 / 9.5.1), audit who holds source-map write permissions, and if you suspect exploitation, locate and purge stored source maps before restarting the service to break the crash loop.

Sources:NVDCISA KEVdiscuss.elastic.coATLAS

What is the risk?

Medium severity is appropriate: the attack is trivial to execute once access is obtained (AC:L, no user interaction), but the high privilege requirement (PR:H — write access to source map ingestion) meaningfully narrows the realistic attacker population to insiders, compromised CI/CD pipelines, or attackers who've already escalated access. Impact is availability-only (C:N/I:N/A:H) but persistent — the crash recurs on every restart until the stored artifact is removed, which elevates operational severity above a typical one-shot DoS. No KEV listing, no EPSS score, and no public PoC or Nuclei template were found, indicating no evidence of active or imminent exploitation.

How does the attack unfold?

Privileged Access

Attacker obtains valid authenticated credentials with write access to the APM Server source map ingestion endpoint (e.g., a compromised CI/CD key).

AML.T0012

Malicious Payload Upload

Attacker uploads a specially crafted, highly compressed source map designed to expand to an enormous size when decompressed.

Trigger & Crash

APM Server processes the stored source map, allocates excessive memory attempting to decompress it, and the process crashes.

AML.T0034.001

Persistent Denial of Service

The malicious artifact remains stored, so the crash recurs on every restart, degrading observability for downstream services (including AI/LLM pipelines) until an admin manually removes it.

Privileged Access

Attacker obtains valid authenticated credentials with write access to the APM Server source map ingestion endpoint (e.g., a compromised CI/CD key).

AML.T0012

Malicious Payload Upload

Attacker uploads a specially crafted, highly compressed source map designed to expand to an enormous size when decompressed.

Trigger & Crash

APM Server processes the stored source map, allocates excessive memory attempting to decompress it, and the process crashes.

AML.T0034.001

Persistent Denial of Service

The malicious artifact remains stored, so the crash recurs on every restart, degrading observability for downstream services (including AI/LLM pipelines) until an admin manually removes it.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	pip	—	No patch
4.2KPushed 3d ago63% patched~20d to patchFull package profile →

Do you use Microsoft APM? You're affected.

How severe is it?

CVSS 3.1

4.9 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade to the patched APM Server releases referenced in Elastic's advisory (8.19.20, 9.4.5, 9.5.1). 2) Audit and restrict who/what holds write access to source map content — scope it to trusted CI/CD service accounts only, not broad developer roles. 3) If compromise is suspected, before restarting the server, locate and delete any anomalous or unusually large/highly-compressed source map artifacts in storage to break the crash-loop. 4) Monitor for repeated OOM kills or crash-restart loops on APM Server instances as a detection signal. 5) Apply general decompression-bomb hygiene (size/ratio limits) if self-managing source map ingestion.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAML.T0034.001- Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7-AI system security and resilience is evaluated and documented

Frequently Asked Questions

What is CVE-2026-78594?

An authenticated user with write access to APM Server's source map storage can upload a specially crafted, highly compressed file that exhausts server memory the moment it's processed, crashing the process outright. This isn't a remote, unauthenticated exploit — CVSS 4.9 reflects the high privilege bar (PR:H) required — but the persistence mechanism is what makes it operationally painful: the malicious artifact stays in storage, so the server crashes again on every restart until someone manually finds and deletes it, turning a single bad upload into a recurring outage. There's no CISA KEV listing, no EPSS data, and no public exploit or scanner template, so opportunistic exploitation is unlikely; the realistic threat is an insider or a compromised CI/CD credential with source-map write access. Downstream package exposure is minimal (0 tracked dependents), but for any team running APM Server to monitor AI/LLM service latency and health, this is a monitoring blind-spot risk, not a data-loss one. Action: patch to the versions in Elastic's advisory (8.19.20 / 9.4.5 / 9.5.1), audit who holds source-map write permissions, and if you suspect exploitation, locate and purge stored source maps before restarting the service to break the crash loop.

Is CVE-2026-78594 actively exploited?

No confirmed active exploitation of CVE-2026-78594 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-78594?

1) Upgrade to the patched APM Server releases referenced in Elastic's advisory (8.19.20, 9.4.5, 9.5.1). 2) Audit and restrict who/what holds write access to source map content — scope it to trusted CI/CD service accounts only, not broad developer roles. 3) If compromise is suspected, before restarting the server, locate and delete any anomalous or unusually large/highly-compressed source map artifacts in storage to break the crash-loop. 4) Monitor for repeated OOM kills or crash-restart loops on APM Server instances as a detection signal. 5) Apply general decompression-bomb hygiene (size/ratio limits) if self-managing source map ingestion.

What systems are affected by CVE-2026-78594?

This vulnerability affects the following AI/ML architecture patterns: observability/monitoring pipelines for AI services, CI/CD source map ingestion.

What is the CVSS score for CVE-2026-78594?

CVE-2026-78594 has a CVSS v3.1 base score of 4.9 (MEDIUM). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

observability/monitoring pipelines for AI servicesCI/CD source map ingestion

MITRE ATLAS Techniques

AML.T0034.001Resource-Intensive Queries

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Exploitation Scenario

An attacker obtains valid credentials with write access to the source map endpoint — for example, a leaked CI/CD API key used to publish build artifacts. They upload a specially crafted, highly compressed file designed to expand to an enormous size on decompression (a classic decompression-bomb pattern). When APM Server later processes this stored content, it attempts to allocate memory proportional to the decompressed size, exhausts available memory, and the process is killed. Because the malicious file remains in storage, the exact same crash recurs immediately on every subsequent restart, producing a persistent denial of service that silently degrades or disables observability for every service — including AI/LLM services — that the APM Server instance was monitoring, until an administrator manually identifies and removes the offending artifact.

Weaknesses (CWE)

CWE-409Improper Handling of Highly Compressed Data (Data Amplification)CWE-409Improper Handling of Highly Compressed Data (Data Amplification)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification): The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Source: MITRE CWE corpus.