Changes / Elastic Cloud / Elastic Agent enrollment/check-in failures on 9.5.3 (and 9.4.6) with Fleet remote Elasticsearch output
Elastic Cloud: Major incident: Elastic Agent enrollment/check-in failures on 9.5.3 (and 9.4.6) with Fleet remote Elasticsearch output
Summary
A major incident caused Elastic Agents using Fleet's remote Elasticsearch output to crash-loop or fail enrollment/check-in after configuration updates on Fleet Server 9.5.3 and 9.4.6. It ran from 2026-09-09 20:44 UTC to 2026-09-17 10:30 UTC (7 days 13 h). Corrected releases 9.5.4 / 9.4.6 fixed the issue; all known affected deployments recovered.
Machine-written from the diff below (Sol; type: incident outage). Check the diff before relying on it.
What changed
Before: not present
After: Elastic Agent enrollment/check-in failures on 9.5.3 (and 9.4.6) with Fleet remote Elasticsearch output
Before: not present
After: major
Before: not present
After: resolved
Before: not present
After: 2026-09-09 20:44 UTC
Before: not present
After: 2026-09-17 10:30 UTC
Before: not present
After: We've identified a bug in Fleet Server 9.5.3 (also present in 9.4.6) that can cause Elastic Agents to crash-loop and go offline when Fleet pushes a configuration update, including enrollment, a policy change, or a routine revision bump. This only affects policies that use Fleet's remote Elasticsearch output feature.
Recommendation: If you use Fleet's remote Elasticsearch output, do not upgrade to 9.5.3 or 9.4.6 until a fixed version is available. If you're already on an affected version and experiencing agent check-in failures, contact Support for remediation steps.
A fix has been merged and will ship in the next 9.5.x and 9.4.x releases. Known Issue documentation: fleet-server#7791, elastic-agent#16542.
Before: not present
After: We have patched Fleet Server versions 9.5.3 and 9.4.6 with corrected releases deployed as of September 10, 2026 at 21:20 UTC.
- Upgrading to the current 9.4.6 or 9.5.3 releases will not be affected by this bug as the updated release contains the fix.
- If you upgraded to 9.4.6 or 9.5.3 before 21:20 UTC on 10 September 2026, perform the following mitigation:
1. Force restart the Integration Server component of you affected deployment
2. Run cleanup procedures on affected Elastic Agents (see https://support.elastic.co/knowledge/bee1c75c) — required if agents failed to check in or remained offline after the Integration Server restart
Before: not present
After: We have patched Fleet Server versions 9.5.3 and 9.4.6 with corrected releases deployed as of September 10, 2026 at 21:20 UTC.
- Upgrading to the current 9.4.6 or 9.5.3 releases will not be affected by this bug as the updated release contains the fix.
- If you upgraded to 9.4.6 or 9.5.3 before 21:20 UTC on 10 September 2026, perform the following mitigation:
1. Force restart the Integration Server component of you affected deployment
2. Run cleanup procedures on affected Elastic Agents (see https://support.elastic.co/knowledge/bee1c75c) — required if agents failed to check in or remained offline after the Integration Server restart
IMPORTANT: The patched Fleet Server is not available outside Elastic Cloud Enterprise (ECE) Stack Packs and Elastic Cloud Hosted (ECH).
Before: not present
After: We have confirmed that Elastic Agents are no longer experiencing enrollment failures related to this issue. Corrected Fleet Server releases (9.5.4 / 9.4.6) have been available on Elastic Cloud Hosted and Elastic Cloud Enterprise stack packs since September 10, 2026, and all known affected deployments have confirmed recovery.
If you upgraded to an affected release before that time and have not yet applied the mitigation, guidance is available here: https://support.elastic.co/knowledge/bee1c75c.
First version of this incident archived by Rewindex. View the live incident.
History of this incident
| When (UTC) | Change | Kind |
|---|---|---|
| Major incident: Elastic Agent enrollment/check-in failures on 9.5.3 (and 9.4.6) with Fleet remote Elasticsearch output (this change) A major incident caused Elastic Agents using Fleet's remote Elasticsearch output to crash-loop or fail enrollment/check-in after configuration updates on Fleet Server 9.5.3 and 9.4.6. It ran from 2026-09-09 20:44 UTC to 2026-09-17 10:30 UTC (7 days 13 h). Corrected releases 9.5.4 / 9.4.6 fixed the issue; all known affected deployments recovered. | Major incident |
All Elastic Cloud changes → · Elastic Cloud profile · Markdown · JSON