Elastic vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Elastic flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 9.8
• CVE-2014-3120 Elasticsearch Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 8.1
• CVE-2019-7609 Kibana Arbitrary Code ExecutionExploited since Jan 10, 2022 · CVSS 10

Latest high and critical flaws

• CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search requHigh 7.1 · Oct 6, 2026
• CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced dHigh 7.2 · Oct 6, 2026
• CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception.High 8.8 · Oct 6, 2026
• CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation.High 7.3 · Sep 26, 2026
• CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security LeHigh 8.1 · Sep 3, 2026
• CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153).High 8.1 · Sep 3, 2026
• CVE-2026-78604 Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642).High 7.8 · Sep 2, 2026
• CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of priHigh 7.3 · Sep 2, 2026
• CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources High 7.3 · Sep 1, 2026
• CVE-2026-72649 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586).High 8.8 · Sep 1, 2026
• CVE-2026-63137 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).High 8.3 · Sep 1, 2026
• CVE-2024-14047 A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users.High 7.2 · Sep 1, 2026
• CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139).High 7.3 · Aug 13, 2026
• CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122).High 7.1 · Aug 13, 2026
• CVE-2026-72672 The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with KibanaHigh 7.7 · Aug 13, 2026
• CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy.High 7.7 · Aug 13, 2026
• CVE-2026-72669 The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state High 7.6 · Aug 13, 2026
• CVE-2026-72665 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing FunctHigh 8.1 · Aug 13, 2026
• CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62).High 7.3 · Aug 13, 2026
• CVE-2026-72643 Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparisHigh 7.1 · Aug 13, 2026
• CVE-2026-72642 The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from High 8.8 · Aug 13, 2026
• CVE-2026-72632 Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116).High 7.1 · Aug 13, 2026
• CVE-2026-72630 Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122).High 7.1 · Aug 13, 2026
• CVE-2026-72629 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly ConstrHigh 7.1 · Aug 13, 2026
• CVE-2026-56147 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise viHigh 7.1 · Jul 21, 2026