Elastic

Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend

• Vulnerability Report

Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend

Do Son October 7, 2026 0

Elastic fixes 14 Elastic Stack vulnerabilities, including Kibana flaw CVE-2026-102406 and Elasticsearch bug CVE-2026-103007. Upgrade now.

Elastic Patches Two Kibana Flaws — SSRF (CVE-2025-37734) and XSS (CVE-2025-59840) Flaws Affect Multiple Versions

• Vulnerability Report

Elastic Patches Two Kibana Flaws — SSRF (CVE-2025-37734) and XSS (CVE-2025-59840) Flaws Affect Multiple Versions

Do Son November 13, 2025 0

Elastic patched two Kibana flaws: CVE-2025-59840 XSS via Vega visualizations and CVE-2025-37734 (SSRF) via the Observability AI Assistant. Update to v9.2.1 immediately.

Elastic Patches High-Severity Privilege Escalation Flaw in Elastic Cloud Enterprise (CVE-2025-37736)

• Vulnerability Report

Elastic Patches High-Severity Privilege Escalation Flaw in Elastic Cloud Enterprise (CVE-2025-37736)

Do Son November 3, 2025 0

Elastic patched a Critical EoP flaw (CVE-2025-37736) in ECE (v3.8.3/4.0.3) where the readonly user can create admin users and inject new API keys by bypassing authorization checks.

Critical Elastic Cloud Flaw: CVE-2025-37729 (CVSS 9.1) Allows RCE via Jinjava Template Injection

• Vulnerability Report

Critical Elastic Cloud Flaw: CVE-2025-37729 (CVSS 9.1) Allows RCE via Jinjava Template Injection

Do Son October 14, 2025 0

A Critical (CVSS 9.1) flaw (CVE-2025-37729) in Elastic Cloud Enterprise allows authenticated Admin RCE. Attackers exploit Jinjava template injection to exfiltrate data and execute commands.

Elastic Fixes Multiple High-Severity Vulnerabilities in Kibana and Elasticsearch

• Vulnerability Report

Elastic Fixes Multiple High-Severity Vulnerabilities in Kibana and Elasticsearch

Do Son October 7, 2025 0

Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.

Elastic APM Server & Beats Have Local Privilege Escalation Flaws

• Vulnerability

Elastic APM Server & Beats Have Local Privilege Escalation Flaws

Do Son July 30, 2025 0

Elastic patched two local privilege escalation flaws (CVE-2025-0712, CVE-2025-25011) in APM Server and Beats for Windows, allowing local attackers to gain SYSTEM privileges.

High-Severity Flaw in Kibana: Unauthorized Access Possible in Synthetic Monitoring!

• Vulnerability Report

High-Severity Flaw in Kibana: Unauthorized Access Possible in Synthetic Monitoring!

Do Son June 11, 2025 0

A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.

CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution

• Vulnerability

CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution

Do Son May 7, 2025 0

A critical vulnerability in Kibana (CVE-2025-25014) enables arbitrary code execution via prototype pollution. Elastic urges users to patch immediately.

CVE-2025-25015 (CVSS 9.9): Critical Code Execution Vulnerability Patched in Elastic Kibana

• Vulnerability

CVE-2025-25015 (CVSS 9.9): Critical Code Execution Vulnerability Patched in Elastic Kibana

Do Son March 5, 2025 0

Learn about CVE-2025-25015: a serious vulnerability in Kibana that poses risks of arbitrary code execution on systems.

CVE-2024-52975 (CVSS 9.0): Fleet Server Update Patches Critical Information Exposure Vulnerability

• Vulnerability

CVE-2024-52975 (CVSS 9.0): Fleet Server Update Patches Critical Information Exposure Vulnerability

Do Son January 26, 2025 0

Critical security update for Elastic Fleet Server - CVE-2024-52975. Protect your sensitive information and prevent data breaches.