Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-78594Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
- CVE-2026-78604Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- CVE-2026-78602Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure
- CVE-2026-78601Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
- CVE-2026-78600Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
- CVE-2026-78609Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data
- CVE-2026-63138Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
- CVE-2026-78597Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
- CVE-2026-78592Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
- CVE-2026-78606Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
- CVE-2026-78603Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
- CVE-2026-78607Missing Authorization in Elasticsearch Leading to Information Disclosure
- CVE-2026-78608Missing Authorization in Kibana Leading to Information Disclosure
- CVE-2026-78605Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
- CVE-2026-72654Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
- CVE-2026-72633Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
- CVE-2026-72641Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data
- CVE-2026-72628Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
- CVE-2026-72644Uncaught Exception in Kibana Leading to Denial of Service
- CVE-2026-72649Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-72682Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-63137Incorrect Authorization in Kibana Leading to Privilege Escalation
- CVE-2026-72652Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-56143Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-33465Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2024-14047Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service
- CVE-2026-78581Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
- CVE-2026-49096Uncaught Exception in Kibana Cases Leading to Denial of Service
- CVE-2026-72636Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service
- CVE-2026-72632Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys