Elastic Elastic

Known Exploited Elastic Vulnerabilities

The following Elastic vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 6 vulnerabilities in Elastic with an average score of 6.9 out of ten. Last year, in 2025 Elastic had 41 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Elastic in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.32.

Recent Elastic Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-0532	Jan 14, 2026	External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.	Kibana
CVE-2026-0529	Jan 14, 2026	Improper Validation of Array Index (CWE-129) in Packetbeats MongoDB protocol parser can Improper Validation of Array Index (CWE-129) in Packetbeats MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol parsing is enabled.
CVE-2026-0543	Jan 13, 2026	Improper Input Validation (CWE-20) in Kibana's Email Connector can Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.	Kibana
CVE-2026-0531	Jan 13, 2026	Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.	Kibana
CVE-2026-0530	Jan 13, 2026	Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.	Kibana
CVE-2026-0528	Jan 13, 2026	Improper Validation of Array Index (CWE-129) exists in Metricbeat can Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
CVE-2025-68422	Dec 18, 2025	Kibana Privilege Escalation via AuthBypass HTTP Request (CVE-2025-68422) Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.	Kibana
CVE-2025-68386	Dec 18, 2025	Kibana: Improper Auth Enables Global Document Sharing (CWE-285) Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.	Kibana
CVE-2025-68390	Dec 18, 2025	Elasticsearch Excessive Memory Allocation via Snapshot Restore (DoS) Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.	Elasticsearch
CVE-2025-68389	Dec 18, 2025	Kibana Resource Leak: Authenticated DoS via Crafted HTTP (CVE-2025-68389) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.	Kibana
CVE-2025-68387	Dec 18, 2025	Vega XSS via Vulnerable AST Evaluator Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.	Kibana
CVE-2025-68385	Dec 18, 2025	Vega XSS via Input Neutralization Bypass (CVE-2025-68385) Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.	Kibana
CVE-2025-68384	Dec 18, 2025	Elasticsearch OOM DoS: Unrestricted User Settings Allocation Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.	Elasticsearch
CVE-2025-68383	Dec 18, 2025	Filebeat Syslog/Dissect BUF Overflow via Malformed Msg/Tokenizer Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
CVE-2025-68382	Dec 18, 2025	NFS OOB Read Causing DoS (CVE-2025-68382) Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.
CVE-2025-68381	Dec 18, 2025	Packetbeat Buffer Overflow via Malformed UDP Packet (CWE-787) Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.
CVE-2025-68388	Dec 18, 2025	Packetbeat DoS: Resource Allocation via Malicious IPv4 Fragments (CWE-770) Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.
CVE-2025-37731	Dec 15, 2025	Elasticsearch PKI Realm Improper Auth Leads to User Impersonation Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.	Elasticsearch
CVE-2025-37732	Dec 15, 2025	SAP Enterprise Portal Auth XSS via Integration Package Upload Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a users browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.	Kibana
CVE-2025-37734	Nov 12, 2025	SSRF via Forged Origin Header in Kibana Observability AI Assistant Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.	Kibana
CVE-2025-37736	Nov 07, 2025	Elastic CE improper auth allows privilege escalation via readonly APIs Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/_all delete:/users/auth/keys/{api_key_id} delete:/users/{user_id}/auth/keys delete:/users/{user_id}/auth/keys/{api_key_id} delete:/users/{user_name} patch:/users/{user_name}	Elastic Cloud Enterprise
CVE-2025-37735	Nov 06, 2025	Elastic Defend WOS Improper Perm Preservation Enables File Deletion & LPE Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.	Kibana
CVE-2025-37729	Oct 13, 2025	CVE-2025-37729: ECE Jinjava Template Injection RCE Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.	Elastic Cloud Enterprise
CVE-2025-37727	Oct 10, 2025	Elasticsearch: Sensitive Data Log Logging via reindex API (CVE-2025-37727) Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex	Elasticsearch
CVE-2025-25017	Oct 10, 2025	Kibana XSS via Improper Input Neutralization in Web Page Generation Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)	Kibana
CVE-2025-25018	Oct 10, 2025	Kibana Stored XSS due to Improper Input Neutralization Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)	Kibana
CVE-2025-25009	Oct 07, 2025	Kibana Stored XSS via Unescaped Inputs in Case File Upload Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.	Kibana
CVE-2025-37728	Oct 07, 2025	Insuff. Protected Credentials in CrowdStrike Connector Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.	Kibana
CVE-2025-25012	Jun 25, 2025	Kibana Open Redirect (CVE-2025-25012) URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.	Kibana
CVE-2024-43706	Jun 10, 2025	Kibana Improper Auth: Privilege Abuse via Synthetic Monitor Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.	Kibana
CVE-2025-37730	May 06, 2025	Improper cert validation in Logstash TCP output (MitM) Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in client mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.	Logstash
CVE-2025-25014	May 06, 2025	Prototype Pollution in Kibana Enables Arbitrary Code Execution A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.	Kibana
CVE-2025-25016	May 01, 2025	Kibana Unrestricted File Upload CVE-2025-25016 Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.	Kibana
CVE-2024-52979	May 01, 2025	Elasticsearch DoS via Uncontrolled Resource Consumption in Mustache Templates Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.	Elasticsearch
CVE-2024-11994	May 01, 2025	Elastic APM Server Log Info Disclosure via Failed Bulk Index APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.	Apm Server
CVE-2024-11390	May 01, 2025	Kibana Synthetics Unrestricted Upload Allows XSS via crafted files Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victims browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.	Kibana
CVE-2024-12556	Apr 08, 2025	Kibana Prototype Pollution Permits Code Exec via Unrestricted Upload & Path Trv Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.	Kibana
CVE-2024-52974	Apr 08, 2025	Kibana Observability API Crash via Malicious Request (Read Access Required) An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.	Kibana
CVE-2024-52980	Apr 08, 2025	Elasticsearch PatternBank Recursion Crash Exploitable with read_pipeline A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.	Elasticsearch
CVE-2024-52981	Apr 08, 2025	Elasticsearch stack overflow via recursive GeometryCollection WKT An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.	Elasticsearch
CVE-2025-25015	Mar 05, 2025	Kibana 8.15-8.17 Prototype Pollution -> Arbitrary Code Exec via Crafted Upload Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors	Kibana
CVE-2024-43708	Jan 23, 2025	Kibana Resource Exhaustion via UI Payload (CVE-2024-43708) An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.	Kibana
CVE-2024-52972	Jan 23, 2025	Kibana: Unbounded Resource Allocation Crash via /api/metrics/snapshot An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.	Kibana
CVE-2024-43710	Jan 23, 2025	CVE-2024-43710: SSRF via Kibana Fleet /api/health_check API A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.	Kibana
CVE-2024-43707	Jan 23, 2025	Kibana: Fleet Policy Leakage to Unauthorized Users An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.	Kibana
CVE-2024-43709	Jan 21, 2025	ElasticSearch: Unbounded Resource Allocation via SQL Query OOM Crash An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.	Elasticsearch
CVE-2024-52973	Jan 21, 2025	Kibana Crash: Unlimited Resource Allocation via /api/log_entries/summary An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.	Kibana
CVE-2024-12539	Dec 17, 2024	Elasticsearch Improper Authorization Vulnerability in Document Level Security An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.	Elasticsearch
CVE-2024-37285	Nov 14, 2024	Kibana YAML Deserialization RCE Requires Index & Fleet Privileges A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Servers service account token	Kibana
CVE-2024-37288	Sep 09, 2024	Kibana Arbitrary Code Exec via YAML Deserialization in Elastic AI A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Securitys built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .	Kibana