Elastic Cloud CVEs

231 vulnerabilities mapped to Elastic Cloud’s software or packages, 3 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

Elastic Cloud CVEs per week, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-09-01
CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
CVSS 4.2 mediumEPSS 0.23%
2026-09-01
CVE-2026-78603 Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
CVSS 4.3 mediumEPSS 0.29%
2026-09-01
CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure
CVSS 5.4 mediumEPSS 0.33%
2026-09-01
CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.38%
2026-09-01
CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
CVSS 5.9 mediumEPSS 0.34%
2026-09-01
CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.51%
2026-09-01
CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
CVSS 4.3 mediumEPSS 0.27%
2026-09-01
CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data
CVSS 5.4 mediumEPSS 0.31%
2026-09-01
CVE-2026-72628 Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.47%
2026-09-01
CVE-2026-72644 Uncaught Exception in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-09-01
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
CVSS 8.8 highEPSS 0.92%
2026-09-01
CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.47%
2026-09-01
CVE-2026-63137 Incorrect Authorization in Kibana Leading to Privilege Escalation
CVSS 8.3 highEPSS 0.50%
2026-09-01
CVE-2026-72652 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-09-01
CVE-2026-56143 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
CVSS 4.9 mediumEPSS 0.44%
2026-09-01
CVE-2026-33465 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-09-01
CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service
CVSS 7.2 highEPSS 0.14%
2026-08-25
CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
CVSS 4.2 mediumEPSS 0.20%
2026-08-13
CVE-2026-49096 Uncaught Exception in Kibana Cases Leading to Denial of Service
CVSS 4.3 mediumEPSS 0.29%
2026-08-13
CVE-2026-72636 Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
CVSS 7.1 highEPSS 0.35%
2026-08-13
CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys
CVSS 6.5 mediumEPSS 0.33%
2026-08-13
CVE-2026-72630 Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation
CVSS 7.1 highEPSS 0.31%
2026-08-13
CVE-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models
CVSS 7.1 highEPSS 0.42%
2026-08-13
CVE-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents
CVSS 7.1 highEPSS 0.38%
2026-08-13
CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
CVSS 8.8 highEPSS 0.60%
2026-08-13
CVE-2026-72640 Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure
CVSS 6.5 mediumEPSS 0.37%
2026-08-13
CVE-2026-72639 Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72638 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72647 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72645 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72648 Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.43%
2026-08-13
CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.38%
2026-08-13
CVE-2026-72656 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification
CVSS 4.3 mediumEPSS 0.31%
2026-08-13
CVE-2026-72653 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72651 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
CVSS 4.3 mediumEPSS 0.34%
2026-08-13
CVE-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.47%
2026-08-13
CVE-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.38%
2026-08-13
CVE-2026-72660 Uncaught Exception in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.52%
2026-08-13
CVE-2026-72659 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
CVSS 7.3 highEPSS 0.19%
2026-08-13
CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%
2026-08-13
CVE-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
CVSS 6.8 mediumEPSS 0.37%
2026-08-13
CVE-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
CVSS 8.1 highEPSS 0.47%
2026-08-13
CVE-2026-72664 Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions
CVSS 6.5 mediumEPSS 0.40%
2026-08-13
CVE-2026-72677 Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
CVSS 7.3 highEPSS 0.41%
2026-08-13
CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection
CVSS 6.5 mediumEPSS 0.55%
2026-08-13
CVE-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification
CVSS 7.1 highEPSS 0.31%

All vendors’ CVEs · JSON · Markdown