Elastic Cloud CVEs

231 vulnerabilities mapped to Elastic Cloud’s software or packages, 3 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

Elastic Cloud CVEs per week, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-10-06
CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
CVSS 7.1 highEPSS 0.23%
2026-10-06
CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.31%
2026-10-06
CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
CVSS 7.2 highEPSS 0.34%
2026-10-06
CVE-2026-103006 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.41%
2026-10-06
CVE-2026-103005 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.31%
2026-10-06
CVE-2026-102413 Uncaught Exception in Elastic Endpoint Leading to Denial of Service
CVSS 6.2 mediumEPSS 0.13%
2026-10-06
CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
CVSS 6.5 mediumEPSS 0.31%
2026-10-06
CVE-2026-102411 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.31%
2026-10-06
CVE-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
CVSS 4.3 mediumEPSS 0.21%
2026-10-06
CVE-2026-102409 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.31%
2026-10-06
CVE-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
CVSS 4.3 mediumEPSS 0.35%
2026-10-06
CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
CVSS 5.4 mediumEPSS 0.22%
2026-10-06
CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
CVSS 8.8 highEPSS 0.35%
2026-10-06
CVE-2026-102404 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.31%
2026-09-26
CVE-2026-94408 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
CVSS 4.9 mediumEPSS 0.25%
2026-09-26
CVE-2026-94397 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-94396 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-94400 Uncontrolled Resource Consumption in Kibana Leading to denial of service
CVSS 6.5 mediumEPSS 0.25%
2026-09-26
CVE-2026-94399 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-94398 Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-82300 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-82294 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.24%
2026-09-26
CVE-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
CVSS 6.5 mediumEPSS 0.19%
2026-09-26
CVE-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
CVSS 6.3 mediumEPSS 0.18%
2026-09-26
CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
CVSS 7.3 highEPSS 0.19%
2026-09-03
CVE-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification
CVSS 8.1 highEPSS 0.39%
2026-09-03
CVE-2026-82299 Incorrect Authorization in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.38%
2026-09-03
CVE-2026-82298 Incorrect Authorization in Kibana Leading to Denial of Service
CVSS 4.3 mediumEPSS 0.37%
2026-09-03
CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
CVSS 4.3 mediumEPSS 0.27%
2026-09-03
CVE-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure
CVSS 4.3 mediumEPSS 0.28%
2026-09-03
CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
CVSS 4.3 mediumEPSS 0.29%
2026-09-03
CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation
CVSS 8.1 highEPSS 0.39%
2026-09-02
CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption
CVSS 4.3 mediumEPSS 0.37%
2026-09-02
CVE-2026-78588 Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-09-02
CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
CVSS 3.1 lowEPSS 0.30%
2026-09-02
CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.47%
2026-09-02
CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
CVSS 4.3 mediumEPSS 0.31%
2026-09-02
CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion
CVSS 6.3 mediumEPSS 0.36%
2026-09-02
CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
CVSS 7.3 highEPSS 0.41%
2026-09-02
CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
CVSS 6.5 mediumEPSS 0.48%
2026-09-02
CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data
CVSS 5.4 mediumEPSS 0.24%
2026-09-02
CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
CVSS 4.9 mediumEPSS 0.50%
2026-09-02
CVE-2026-78604 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
CVSS 7.8 highEPSS 0.15%
2026-09-02
CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure
CVSS 5.3 mediumEPSS 0.56%
2026-09-02
CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
CVSS 5.5 mediumEPSS 0.35%
2026-09-02
CVE-2026-78600 Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
CVSS 3.5 lowEPSS 0.28%
2026-09-02
CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data
CVSS 5.4 mediumEPSS 0.15%
2026-09-01
CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.47%
2026-09-01
CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
CVSS 4.3 mediumEPSS 0.29%
2026-09-01
CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
CVSS 7.3 highEPSS 0.41%

All vendors’ CVEs · JSON · Markdown