Elastic Cloud CVEs
231 vulnerabilities mapped to Elastic Cloud’s software or packages, 3 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-33464 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.27%
CVE-2026-33462 Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts
CVSS 4.6 mediumEPSS 0.24%
CVE-2026-33459 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.27%
CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
CVSS 4.3 mediumEPSS 0.18%
CVE-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
CVSS 7.7 highEPSS 0.28%
CVE-2026-26940 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.28%
CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
CVSS 5.7 mediumEPSS 0.25%
CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
CVSS 5.7 mediumEPSS 0.19%
CVE-2026-26937 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.32%
CVE-2026-26936 Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service
CVSS 4.9 mediumEPSS 0.37%
CVE-2026-26935 Improper Input Validation in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.32%
CVE-2026-26934 Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.32%
CVE-2026-26932 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
CVSS 5.7 mediumEPSS 0.51%
CVE-2026-0529 Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers
CVSS 6.5 mediumEPSS 0.23%
CVE-2026-0543 Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
CVSS 6.5 mediumEPSS 0.43%
CVE-2026-0531 Allocation of Resources Without Limits or Throttling in Kibana Fleet
CVSS 6.5 mediumEPSS 0.49%
CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.43%
CVE-2025-68422 Kibana Improper Authorization
CVSS 4.3 mediumEPSS 0.23%
CVE-2025-68386 Kibana Improper Authorization
CVSS 4.3 mediumEPSS 0.19%
CVE-2025-68390 Elasticsearch Allocation of Resources Without Limits or Throttling
CVSS 4.9 mediumEPSS 0.38%
CVE-2025-68389 Kibana Allocation of Resources Without Limits or Throttling
CVSS 6.5 mediumEPSS 0.31%
CVE-2025-68384 Elasticsearch Allocation of Resources Without Limits or Throttling
CVSS 6.5 mediumEPSS 0.32%
CVE-2025-68383 Filebeat Improper Validation of Specified Index, Position, or Offset in Input
CVSS 6.5 mediumEPSS 0.19%
CVE-2025-68382 Packetbeat Out-of-bounds Read
CVSS 6.5 mediumEPSS 0.25%
CVE-2025-68381 Packetbeat Improper Bounds Check
CVSS 6.5 mediumEPSS 0.46%
CVSS 5.3 mediumEPSS 0.41%
CVE-2025-37731 Elasticsearch Improper Authentication
CVSS 6.8 mediumEPSS 0.19%
CVE-2025-37732 Kibana Cross-site Scripting via the Integration Package Upload Functionality
CVSS 5.4 mediumEPSS 0.18%
CVE-2025-37734 Kibana Origin Validation Error
CVSS 4.3 mediumEPSS 0.21%
CVE-2025-37736 Elastic Cloud Enterprise Improper Authorization
CVSS 8.8 highEPSS 0.40%
CVSS 7.0 highEPSS 0.14%
CVE-2025-37727 Elasticsearch Insertion of sensitive information in log file
CVSS 5.7 mediumEPSS 0.25%
CVE-2025-25017 Kibana Stored Cross-Site Scripting (XSS)
CVSS 8.2 highEPSS 0.27%
CVE-2025-25018 Kibana Stored Cross-Site Scripting (XSS)
CVSS 8.7 highEPSS 0.23%
CVE-2025-25009 Kibana Cross-Site Scripting (XSS)
CVSS 8.7 highEPSS 0.24%
CVE-2025-37728 Kibana Insufficiently Protected Credentials in the CrowdStrike Connector
CVSS 5.4 mediumEPSS 0.27%
CVE-2025-25010 Kibana privilege escalation via reporting_user role
CVSS 6.5 mediumEPSS 0.28%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)