Elastic Elastic

Known Exploited Elastic Vulnerabilities

The following Elastic vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 61 vulnerabilities in Elastic with an average score of 6.2 out of ten. Last year, in 2025 Elastic had 41 security vulnerabilities published. That is, 20 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.55

Recent Elastic Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-63263	Jul 21, 2026	Elasticsearch ES|QL CPU Exhaustion via Exponential Data Expansion Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.	Elasticsearch
CVE-2026-63262	Jul 21, 2026	CVE-2026-63262: Auth Bypass in Kibana Enables Cross-space Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.	Kibana
CVE-2026-63261	Jul 21, 2026	Kibana ML Feature Uncontrolled Resource Consumption (CWE-400) DoS Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.	Kibana
CVE-2026-63260	Jul 21, 2026	Kibana Uncontrolled Resource Consumption via Oversized Payload DoS Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.	Kibana
CVE-2026-63259	Jul 21, 2026	Kibana Auth Bypass via User-Key Exposes Scheduled Query Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.	Kibana
CVE-2026-63145	Jul 21, 2026	Kibana ML ACL Bypass Enables Audit & Notification Record Manipulation Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobsincluding jobs in other spaces or belonging to other usersby leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.	Kibana
CVE-2026-63144	Jul 21, 2026	Elasticsearch Recursion DoS via Malicious Query (CVE-2026-63144) Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.	Elasticsearch
CVE-2026-63143	Jul 21, 2026	Missing Auth in Kibana Unauthorized Data Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.	Kibana
CVE-2026-63142	Jul 21, 2026	Kibana Reporting: Auth Bypass via Missing Disallowed Inputs (CWE-184) Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.	Kibana
CVE-2026-63141	Jul 21, 2026	Kibana Auth Bypass: Authenticated Users can Modify Cloud Connect Settings Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.	Kibana
CVE-2026-63140	Jul 21, 2026	Elasticsearch DoS via Assertion Failure in Query Parsing Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.	Elasticsearch
CVE-2026-63139	Jul 21, 2026	Kibana Canvas Authenticated DoS via Uncontrolled Resource Consumption Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.	Kibana
CVE-2026-63136	Jul 21, 2026	Elasticsearch CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.	Elasticsearch
CVE-2026-56147	Jul 21, 2026	Kibana Auth Bypass via UserControlled Key (CWE639) Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments such as those associated with Security Solution cases without holding the privileges required to access those features.	Kibana
CVE-2026-56146	Jul 21, 2026	Kibana Improper Access Control Enables Unauthorized Watchlist Modification Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.	Kibana
CVE-2026-56145	Jul 21, 2026	Elasticsearch Uncontrolled Resource Consumption via EQL Query Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.	Elasticsearch
CVE-2026-56144	Jul 21, 2026	Elasticsearch Ingest Simulation Auth Bypass (CWE-863) Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.	Elasticsearch
CVE-2026-42397	Jul 21, 2026	DoS via Oversized Input in Kibana Entity Analytics Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.	Kibana
CVE-2026-49092	Jul 21, 2026	Kibana Confused Deputy Proxy Privilege Escalation Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.	Kibana
CVE-2026-49091	Jul 01, 2026	Log Injection Vulnerability (CWE-117) in Kibana (Elastic) Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.	Kibana
CVE-2026-49090	Jul 01, 2026	Uncontrolled Resource Consumption in Elasticsearch Bulk Request Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.	Elasticsearch
CVE-2026-49088	Jul 01, 2026	Kibana APM Logs Leak Sensitive Headers via Log Injection (CWE-532) Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.	Kibana
CVE-2026-49087	Jul 01, 2026	Kibana DoS via Excessive Bulk Deletion Resource Exhaustion Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.	Kibana
CVE-2026-56152	Jul 01, 2026	CVE-2026-56152: Elastic Defend Unauthorized Disclosure via ACL Bypass Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.
CVE-2026-56151	Jul 01, 2026	Kibana Improper Input Validation Allows Authenticated DoS Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.	Kibana
CVE-2026-56150	Jul 01, 2026	Elastic Fleet Server Excessive Alloc Leading to DoS Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.
CVE-2026-56149	Jul 01, 2026	Elasticsearch ML Request DOS via CVE-2026-56149 (CWE-770) Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.	Elasticsearch
CVE-2026-56148	Jul 01, 2026	Elasticsearch Uncontrolled Recursion CVE-2026-56148 (Denial of Service) Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.	Elasticsearch
CVE-2026-49093	May 28, 2026	Kibana SSRF Allowlist Bypass via Connector Permissions Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.	Kibana
CVE-2026-49094	May 28, 2026	Kibana CVE-2026-49094: Auth Viewer DoS via Oversized Input Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.	Kibana
CVE-2026-49095	May 28, 2026	Kibana Fleet Policy Injection Privilege Escalation Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.	Kibana
CVE-2026-42398	May 28, 2026	Kibana SSRF Auth Users Bypass Egress Allowlist via Webhook Connector Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.	Kibana
CVE-2026-42399	May 28, 2026	Kibana Uncontrolled Resource Consumption via Crafty Timelion Expr (CAPEC-130) Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.	Kibana
CVE-2026-42400	May 28, 2026	Kibana Resource Exhaustion via Authenticated Compressed Payload Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.	Kibana
CVE-2026-42401	May 28, 2026	Kibana Stored XSS via Unsanitized Index Data (CWE79) Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.	Kibana
CVE-2026-33463	May 28, 2026	Kibana Token Bypass: Post-Expiration Access (CVE-2026-33463) Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.	Kibana
CVE-2026-33464	May 28, 2026	Kibana Uncontrolled Resource Consumption via Oversized Payload (CVE-2026-33464) Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.	Kibana
CVE-2026-33462	May 28, 2026	Kibana Dashboard PKG Path Traversal Allows Admin Deletion of Arbitrary Accounts A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.	Kibana
CVE-2026-33467	Apr 28, 2026	Elastic Package Registry Improper Signature Verification (CWE-347) Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
CVE-2026-33466	Apr 08, 2026	Logstash Archive Path Traversal Enables RCE Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution.	Logstash
CVE-2026-33458	Apr 08, 2026	SSRF in Kibana One Workflow allows internal endpoint disclosure Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.	Kibana
CVE-2026-33459	Apr 08, 2026	Kibana Authenticated DoS via Excessive Allocation in Automatic Import Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.	Kibana
CVE-2026-33460	Apr 08, 2026	Kibana Auth Bypass via Unscoped Client Leaks Cross-Space Data Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.	Kibana
CVE-2026-33461	Apr 08, 2026	Kibana Internal API Auth Bypass Exposing Sensitive Config Data Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.	Kibana
CVE-2026-4498	Apr 08, 2026	CVE-2026-4498: Kibana Fleet Plugin Debug Route Privilege Abuse (CWE-250) Execution with Unnecessary Privileges (CWE-250) in Kibanas Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).	Kibana
CVE-2026-26940	Mar 19, 2026	Kibana Timelion Plugin DOS via Overly Large Quantity Value Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.	Kibana
CVE-2026-26939	Mar 19, 2026	Auth Bypass in Kibana Rule Management (CVE-2026-26939) Missing Authorization (CWE-862) in Kibanas server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.	Kibana
CVE-2026-26933	Mar 19, 2026	CVE-2026-26933: Packetbeat OOB Read via Malformed Network Packets Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
CVE-2026-26931	Mar 19, 2026	Metricbeat Remote_write Handler: Excessive Size Value Causing DoS Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
CVE-2026-26938	Feb 26, 2026	Elastic Kibana Workflows RCE via ServerSide Template Injection Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.	Kibana