Elastic Elastic

Known Exploited Elastic Vulnerabilities

The following Elastic vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 175 vulnerabilities in Elastic with an average score of 6.2 out of ten. Last year, in 2025 Elastic had 41 security vulnerabilities published. That is, 134 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.56

Recent Elastic Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-115714	Nov 03, 2026	Elastic Stack: Cert Validation Flaw via Compromised OS Bundle Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
CVE-2026-115716	Nov 03, 2026	Elastic APM Server DoS via Unbounded OTLP Payload (CWE-770) Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.	Apm Server
CVE-2026-115715	Nov 03, 2026	Elasticsearch Policy: Phonetic Encoder Resource Exhaustion Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.	Elasticsearch
CVE-2026-115710	Nov 03, 2026	Elasticsearch Cache Disclosure via FLS Misuse Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.	Elasticsearch
CVE-2026-115298	Nov 03, 2026	ES FLS Bypass: Auth User Reads Excluded Const_Keyword Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.	Elasticsearch
CVE-2026-115297	Nov 03, 2026	Packetbeat AMQP Parser NULL Pointer Deref DoS NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.
CVE-2026-115295	Nov 03, 2026	Elastic Kibana Auth Bypass via User-Cont Key: Unauthorized Log Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.	Kibana
CVE-2026-115294	Nov 03, 2026	Kibana Fleet Path Traversal Allows Deletion of Spaces Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.	Kibana
CVE-2026-115293	Nov 03, 2026	Sensitive Credential Exposure in Kibana Observability Onboarding Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.	Kibana
CVE-2026-115292	Nov 03, 2026	Kibana ML ACL Bypass -> Cross-Space Audit Log Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.	Kibana
CVE-2026-115290	Nov 03, 2026	Elasticsearch Uncontrolled Recursion (CWE674) in Serialized Data for DoS Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.	Elasticsearch
CVE-2026-115289	Nov 03, 2026	OPA15: Elastic APM Server Unintended Config Exposure via Duplicate IDs Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.	Apm Server
CVE-2026-94408	Sep 26, 2026	Elasticsearch CVE-2026-94408: Uncontrolled Res. Cons. (CWE-400) DoS Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)	Elasticsearch
CVE-2026-94397	Sep 26, 2026	Elasticsearch Uncontrolled Resource Cons. (CWE400) Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)	Elasticsearch
CVE-2026-94396	Sep 26, 2026	Elasticsearch Uncontrolled Resource Consumption DoS Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)	Elasticsearch
CVE-2026-94400	Sep 26, 2026	Kibana Uncontrolled Resource Consumption: Potential DoS via Excessive Allocation Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)	Kibana
CVE-2026-94399	Sep 26, 2026	Elasticsearch DoS via Uncontrolled Resource Consumption (CWE-400) Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)	Elasticsearch
CVE-2026-94398	Sep 26, 2026	Elasticsearch Uncontrolled Resource Consumption (CWE-400) CAPEC-130 DoS Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)	Elasticsearch
CVE-2026-82300	Sep 26, 2026	Elasticsearch DoS via Uncontrolled Resource Consumption (CWE-400) Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).	Elasticsearch
CVE-2026-82294	Sep 26, 2026	Elasticsearch DoS via Uncontrolled Resource Consumption Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).	Elasticsearch
CVE-2026-78582	Sep 26, 2026	Kibana Missing Auth: Unauthorized Deletion of Synthetics Monitors Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.	Kibana
CVE-2026-72662	Sep 26, 2026	Kibana Authorization Bypass via User-Controlled Key (CWE-639) Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.	Kibana
CVE-2026-72668	Sep 26, 2026	Kibana Agent Builder Confused Deputy Privilege Escalation Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.	Kibana
CVE-2026-82302	Sep 03, 2026	Kibana Unauthorized Config Mod via Incorrect Authorization (CWE-863) Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).	Kibana
CVE-2026-82299	Sep 03, 2026	Kibana Incorrect Auth (CWE-863) Enables Info Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).	Kibana
CVE-2026-82298	Sep 03, 2026	Kibana Incorrect Authorization Leading to DoS via Misconfigured Access Control Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).	Kibana
CVE-2026-78596	Sep 03, 2026	Kibana Missing Auth: Unauthorized Data Mod via Space Migration Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.	Kibana
CVE-2026-78595	Sep 03, 2026	Missing Auth in Kibana Fleet: Read-Only Agent Credentials Leak Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.	Kibana
CVE-2026-78593	Sep 03, 2026	Kibana Cribl RCE via Insufficient Validation of Config Field An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.	Kibana
CVE-2026-78583	Sep 03, 2026	CVE-2026-78583: Kibana Privilege Escalation via Unvalidated Agent Credentials Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.	Kibana
CVE-2026-82293	Sep 02, 2026	Kibana ML Feature - Incorrect Auth. Enables Unauthorized Resource Consumption Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.	Kibana
CVE-2026-78588	Sep 02, 2026	Filebeat HTTP ingestion endpoint allows unchecked memory allocation Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.
CVE-2026-78587	Sep 02, 2026	Fleet Server Auth Bypass Enables Agent Upload Denial of Service Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
CVE-2026-78586	Sep 02, 2026	Kibana Unbounded Memory Allocation Leads to DoS by Low-Priv Auth User Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.	Kibana
CVE-2026-78584	Sep 02, 2026	Kibana Osquery LiveQuery Disclosure via Identifier Existence Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.	Kibana
CVE-2026-78591	Sep 02, 2026	Kibana Fleet Path Traversal leads to unauthorized deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.	Kibana
CVE-2026-78590	Sep 02, 2026	Elastic Kibana Fleet Path Traversal Deletion Vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.	Kibana
CVE-2026-78599	Sep 02, 2026	Kibana Fleet Path Traversal Violation Leads to Deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.	Kibana
CVE-2026-78598	Sep 02, 2026	Kibana ML Job Auth Escalation: CrossSpace Data Exposure Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.	Kibana
CVE-2026-78594	Sep 02, 2026	APM Server Denial via Highly Compressed Source Map (CWE409/CAPEC130) Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.	Apm Server
CVE-2026-78604	Sep 02, 2026	Elastic Agent: Incorrect Perm. Assignment Causing Local Priv Escalation Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.	Elastic Agent
CVE-2026-78602	Sep 02, 2026	Elastic Maps Server Path Traversal can expose file contents Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
CVE-2026-78601	Sep 02, 2026	Kibana Entity Store Auth Bypass Exposes Data Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.	Kibana
CVE-2026-78600	Sep 02, 2026	ECK Incomplete Cleanup Enables LowPrivileged Privilege Abuse Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.
CVE-2026-78609	Sep 02, 2026	Incorrect Auth in ECK Enables Namespace-Scoped Metadata Spoofing Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
CVE-2026-63138	Sep 01, 2026	Kibana NoSQLi Enables Unauthorized Data Disclosure Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read.	Kibana
CVE-2026-78597	Sep 01, 2026	Kibana Entity Store Missing Auth: Unauthorized API Key Creation Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.	Kibana
CVE-2026-78592	Sep 01, 2026	Elastic's Kibana Path Traversal (CWE-22) Enables Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface.	Kibana
CVE-2026-78606	Sep 01, 2026	Kibana Unauthorized Access to Elastic AI Assistant KB via ACL flaw Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.	Kibana
CVE-2026-78603	Sep 01, 2026	Kibana RBAC Bypass Enables Fleet Metadata Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.	Kibana