# Elastic Cloud CVEs > Elastic Cloud: 231 CVEs mapped to its software or packages (3 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/elastic-cloud/cves Last updated: 2026-10-06T19:31:53Z 231 CVEs map to Elastic Cloud (3 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Elastic Cloud’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-06 | [CVE-2026-103009](https://rewindex.com/cve/CVE-2026-103009.md) | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure | 7.1 high | | | 2026-10-06 | [CVE-2026-103008](https://rewindex.com/cve/CVE-2026-103008.md) | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-10-06 | [CVE-2026-103007](https://rewindex.com/cve/CVE-2026-103007.md) | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation | 7.2 high | | | 2026-10-06 | [CVE-2026-103006](https://rewindex.com/cve/CVE-2026-103006.md) | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-10-06 | [CVE-2026-103005](https://rewindex.com/cve/CVE-2026-103005.md) | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-10-06 | [CVE-2026-102413](https://rewindex.com/cve/CVE-2026-102413.md) | Uncaught Exception in Elastic Endpoint Leading to Denial of Service | 6.2 medium | | | 2026-10-06 | [CVE-2026-102412](https://rewindex.com/cve/CVE-2026-102412.md) | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure | 6.5 medium | | | 2026-10-06 | [CVE-2026-102411](https://rewindex.com/cve/CVE-2026-102411.md) | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-10-06 | [CVE-2026-102410](https://rewindex.com/cve/CVE-2026-102410.md) | Missing Authorization in Kibana Leading to Information Disclosure | 4.3 medium | | | 2026-10-06 | [CVE-2026-102409](https://rewindex.com/cve/CVE-2026-102409.md) | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-10-06 | [CVE-2026-102408](https://rewindex.com/cve/CVE-2026-102408.md) | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service | 4.3 medium | | | 2026-10-06 | [CVE-2026-102407](https://rewindex.com/cve/CVE-2026-102407.md) | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification | 5.4 medium | | | 2026-10-06 | [CVE-2026-102406](https://rewindex.com/cve/CVE-2026-102406.md) | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception | 8.8 high | | | 2026-10-06 | [CVE-2026-102404](https://rewindex.com/cve/CVE-2026-102404.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-09-26 | [CVE-2026-94408](https://rewindex.com/cve/CVE-2026-94408.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | 4.9 medium | | | 2026-09-26 | [CVE-2026-94397](https://rewindex.com/cve/CVE-2026-94397.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | 6.5 medium | | | 2026-09-26 | [CVE-2026-94396](https://rewindex.com/cve/CVE-2026-94396.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | 6.5 medium | | | 2026-09-26 | [CVE-2026-94400](https://rewindex.com/cve/CVE-2026-94400.md) | Uncontrolled Resource Consumption in Kibana Leading to denial of service | 6.5 medium | | | 2026-09-26 | [CVE-2026-94399](https://rewindex.com/cve/CVE-2026-94399.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | 6.5 medium | | | 2026-09-26 | [CVE-2026-94398](https://rewindex.com/cve/CVE-2026-94398.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | 6.5 medium | | | 2026-09-26 | [CVE-2026-82300](https://rewindex.com/cve/CVE-2026-82300.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-09-26 | [CVE-2026-82294](https://rewindex.com/cve/CVE-2026-82294.md) | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | 6.5 medium | | | 2026-09-26 | [CVE-2026-78582](https://rewindex.com/cve/CVE-2026-78582.md) | Missing Authorization in Kibana Leading to Unauthorized Deletion of Data | 6.5 medium | | | 2026-09-26 | [CVE-2026-72662](https://rewindex.com/cve/CVE-2026-72662.md) | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data | 6.3 medium | | | 2026-09-26 | [CVE-2026-72668](https://rewindex.com/cve/CVE-2026-72668.md) | Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation | 7.3 high | | | 2026-09-03 | [CVE-2026-82302](https://rewindex.com/cve/CVE-2026-82302.md) | Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification | 8.1 high | | | 2026-09-03 | [CVE-2026-82299](https://rewindex.com/cve/CVE-2026-82299.md) | Incorrect Authorization in Kibana Leading to Information Disclosure | 6.5 medium | | | 2026-09-03 | [CVE-2026-82298](https://rewindex.com/cve/CVE-2026-82298.md) | Incorrect Authorization in Kibana Leading to Denial of Service | 4.3 medium | | | 2026-09-03 | [CVE-2026-78596](https://rewindex.com/cve/CVE-2026-78596.md) | Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations | 4.3 medium | | | 2026-09-03 | [CVE-2026-78595](https://rewindex.com/cve/CVE-2026-78595.md) | Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure | 4.3 medium | | | 2026-09-03 | [CVE-2026-78593](https://rewindex.com/cve/CVE-2026-78593.md) | Improper Control of Generation of Code in Kibana Leading to Privilege Escalation | 4.3 medium | | | 2026-09-03 | [CVE-2026-78583](https://rewindex.com/cve/CVE-2026-78583.md) | Incorrect Authorization in Kibana Leading to Privilege Escalation | 8.1 high | | | 2026-09-02 | [CVE-2026-82293](https://rewindex.com/cve/CVE-2026-82293.md) | Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption | 4.3 medium | | | 2026-09-02 | [CVE-2026-78588](https://rewindex.com/cve/CVE-2026-78588.md) | Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service | 6.5 medium | | | 2026-09-02 | [CVE-2026-78587](https://rewindex.com/cve/CVE-2026-78587.md) | Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations | 3.1 low | | | 2026-09-02 | [CVE-2026-78586](https://rewindex.com/cve/CVE-2026-78586.md) | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service | 6.5 medium | | | 2026-09-02 | [CVE-2026-78584](https://rewindex.com/cve/CVE-2026-78584.md) | Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure | 4.3 medium | | | 2026-09-02 | [CVE-2026-78591](https://rewindex.com/cve/CVE-2026-78591.md) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion | 6.3 medium | | | 2026-09-02 | [CVE-2026-78590](https://rewindex.com/cve/CVE-2026-78590.md) | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources | 7.3 high | | | 2026-09-02 | [CVE-2026-78599](https://rewindex.com/cve/CVE-2026-78599.md) | Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources | 6.5 medium | | | 2026-09-02 | [CVE-2026-78598](https://rewindex.com/cve/CVE-2026-78598.md) | Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data | 5.4 medium | | | 2026-09-02 | [CVE-2026-78594](https://rewindex.com/cve/CVE-2026-78594.md) | Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service | 4.9 medium | | | 2026-09-02 | [CVE-2026-78604](https://rewindex.com/cve/CVE-2026-78604.md) | Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM | 7.8 high | | | 2026-09-02 | [CVE-2026-78602](https://rewindex.com/cve/CVE-2026-78602.md) | Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure | 5.3 medium | | | 2026-09-02 | [CVE-2026-78601](https://rewindex.com/cve/CVE-2026-78601.md) | Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure | 5.5 medium | | | 2026-09-02 | [CVE-2026-78600](https://rewindex.com/cve/CVE-2026-78600.md) | Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention | 3.5 low | | | 2026-09-02 | [CVE-2026-78609](https://rewindex.com/cve/CVE-2026-78609.md) | Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data | 5.4 medium | | | 2026-09-01 | [CVE-2026-63138](https://rewindex.com/cve/CVE-2026-63138.md) | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure | 6.5 medium | | | 2026-09-01 | [CVE-2026-78597](https://rewindex.com/cve/CVE-2026-78597.md) | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation | 4.3 medium | | | 2026-09-01 | [CVE-2026-78592](https://rewindex.com/cve/CVE-2026-78592.md) | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources | 7.3 high | | Next page: [page 2](https://rewindex.com/company/elastic-cloud/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Elastic Cloud) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 2 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 1 | 12 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 1 | 5 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 1 | 5 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 4 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 3 | 3 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 2 | 8 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 1 | 8 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 1 | 18 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 12 | 36 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-08-31 | 0 | 8 | 32 | 2 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 1 | 10 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 3 | 11 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/elastic-cloud/cves · Markdown: https://rewindex.com/company/elastic-cloud/cves.md · JSON: https://rewindex.com/api/v1/companies/elastic-cloud/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:05:29.653Z