{"schema_version":1,"title":"Elastic vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 120 vulnerabilities in Elastic: 0 in the last 7 days and 94 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-75897, was published on 9 September 2026. 4 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/elastic","json_url":"https://junglewise.ai/threats/vendors/elastic.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/elastic","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":21,"all_time":120,"critical":3,"exploited":3,"last_7_days":0,"last_30_days":42,"last_90_days":94,"last_365_days":114},"latest":[{"cve":"CVE-2026-75897","cvss":7.5,"slug":"cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in","title":"OpenSearch Dashboards uncontrolled resource consumption in capabilities route","severity":"high","exploited":false,"published_at":"2026-09-09T21:30:11+00:00","url":"https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in"},{"cve":"CVE-2026-82302","cvss":8.1,"epss":0.0039,"slug":"cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:29.827+00:00","url":"https://junglewise.ai/threats/cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-82299","cvss":6.5,"epss":0.0038,"slug":"cve-2026-82299-elastic-kibana-authorization-bypass-leading-to-information","title":"Elastic Kibana authorization bypass leading to information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:29.707+00:00","url":"https://junglewise.ai/threats/cve-2026-82299-elastic-kibana-authorization-bypass-leading-to-information"},{"cve":"CVE-2026-82298","cvss":4.3,"epss":0.0033,"slug":"cve-2026-82298-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:29.587+00:00","url":"https://junglewise.ai/threats/cve-2026-82298-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-78596","cvss":4.3,"epss":0.0027,"slug":"cve-2026-78596-elastic-kibana-authorization-bypass-in-entity-analytics-migration","title":"Elastic Kibana authorization bypass in Entity Analytics migration","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.993+00:00","url":"https://junglewise.ai/threats/cve-2026-78596-elastic-kibana-authorization-bypass-in-entity-analytics-migration"},{"cve":"CVE-2026-78595","cvss":4.3,"epss":0.0028,"slug":"cve-2026-78595-elastic-kibana-missing-authorization-in-fleet-cross-space-data","title":"Elastic Kibana missing authorization in Fleet cross-space data disclosure","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.85+00:00","url":"https://junglewise.ai/threats/cve-2026-78595-elastic-kibana-missing-authorization-in-fleet-cross-space-data"},{"cve":"CVE-2026-78593","cvss":4.3,"epss":0.0029,"slug":"cve-2026-78593-elastic-kibana-code-injection-in-cribl-integration","title":"Elastic Kibana code injection in Cribl integration","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.687+00:00","url":"https://junglewise.ai/threats/cve-2026-78593-elastic-kibana-code-injection-in-cribl-integration"},{"cve":"CVE-2026-78583","cvss":8.1,"epss":0.0039,"slug":"cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration","title":"Elastic Kibana privilege escalation via Fleet integration validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:28.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration"},{"cve":"CVE-2026-82293","cvss":4.3,"epss":0.0037,"slug":"cve-2026-82293-elastic-kibana-authorization-bypass-in-machine-learning","title":"Elastic Kibana authorization bypass in machine learning","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:43.157+00:00","url":"https://junglewise.ai/threats/cve-2026-82293-elastic-kibana-authorization-bypass-in-machine-learning"},{"cve":"CVE-2026-78609","cvss":5.4,"epss":0.0015,"slug":"cve-2026-78609-elastic-cloud-on-kubernetes-incorrect-authorization-in-multi","title":"Elastic Cloud on Kubernetes incorrect authorization in multi-tenant environments","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.827+00:00","url":"https://junglewise.ai/threats/cve-2026-78609-elastic-cloud-on-kubernetes-incorrect-authorization-in-multi"},{"cve":"CVE-2026-78602","cvss":5.3,"epss":0.0056,"slug":"cve-2026-78602-elastic-maps-server-path-traversal-allows-file-disclosure","title":"Elastic Maps Server path traversal allows file disclosure","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.42+00:00","url":"https://junglewise.ai/threats/cve-2026-78602-elastic-maps-server-path-traversal-allows-file-disclosure"},{"cve":"CVE-2026-78601","cvss":5.5,"epss":0.0035,"slug":"cve-2026-78601-elastic-kibana-missing-authorization-in-entity-store","title":"Elastic Kibana missing authorization in Entity Store configuration","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.277+00:00","url":"https://junglewise.ai/threats/cve-2026-78601-elastic-kibana-missing-authorization-in-entity-store"},{"cve":"CVE-2026-78600","cvss":3.5,"epss":0.0028,"slug":"cve-2026-78600-elastic-cloud-on-kubernetes-incomplete-cleanup-leading-to","title":"Elastic Cloud on Kubernetes incomplete cleanup leading to unauthorized access","severity":"low","exploited":false,"published_at":"2026-09-02T15:17:41.137+00:00","url":"https://junglewise.ai/threats/cve-2026-78600-elastic-cloud-on-kubernetes-incomplete-cleanup-leading-to"},{"cve":"CVE-2026-78599","cvss":6.5,"epss":0.0048,"slug":"cve-2026-78599-elastic-kibana-path-traversal-in-fleet-leading-to-unauthorized","title":"Elastic Kibana path traversal in Fleet leading to unauthorized deletion","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.003+00:00","url":"https://junglewise.ai/threats/cve-2026-78599-elastic-kibana-path-traversal-in-fleet-leading-to-unauthorized"},{"cve":"CVE-2026-78598","cvss":5.4,"epss":0.0024,"slug":"cve-2026-78598-elastic-kibana-machine-learning-privilege-escalation-via-space","title":"Elastic Kibana machine learning privilege escalation via space boundary bypass","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.863+00:00","url":"https://junglewise.ai/threats/cve-2026-78598-elastic-kibana-machine-learning-privilege-escalation-via-space"},{"cve":"CVE-2026-78594","cvss":4.9,"epss":0.005,"slug":"cve-2026-78594-elastic-apm-server-improper-handling-of-compressed-data-denial-of","title":"Elastic APM Server improper handling of compressed data denial of service","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.7+00:00","url":"https://junglewise.ai/threats/cve-2026-78594-elastic-apm-server-improper-handling-of-compressed-data-denial-of"},{"cve":"CVE-2026-78591","cvss":6.3,"epss":0.0036,"slug":"cve-2026-78591-elastic-kibana-path-traversal-in-fleet-feature","title":"Elastic Kibana path traversal in Fleet feature","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.57+00:00","url":"https://junglewise.ai/threats/cve-2026-78591-elastic-kibana-path-traversal-in-fleet-feature"},{"cve":"CVE-2026-78590","cvss":7.3,"epss":0.0041,"slug":"cve-2026-78590-elastic-kibana-path-traversal-in-fleet-feature","title":"Elastic Kibana path traversal in Fleet feature","severity":"high","exploited":false,"published_at":"2026-09-02T15:17:40.433+00:00","url":"https://junglewise.ai/threats/cve-2026-78590-elastic-kibana-path-traversal-in-fleet-feature"},{"cve":"CVE-2026-78588","cvss":6.5,"epss":0.0042,"slug":"cve-2026-78588-elastic-filebeat-denial-of-service-via-resource-exhaustion","title":"Elastic Filebeat denial of service via resource exhaustion","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.307+00:00","url":"https://junglewise.ai/threats/cve-2026-78588-elastic-filebeat-denial-of-service-via-resource-exhaustion"},{"cve":"CVE-2026-78587","cvss":3.1,"epss":0.003,"slug":"cve-2026-78587-elastic-fleet-server-incorrect-authorization-in-multi-part-upload","title":"Elastic Fleet Server incorrect authorization in multi-part upload","severity":"low","exploited":false,"published_at":"2026-09-02T15:17:40.19+00:00","url":"https://junglewise.ai/threats/cve-2026-78587-elastic-fleet-server-incorrect-authorization-in-multi-part-upload"},{"cve":"CVE-2026-78586","cvss":6.5,"epss":0.0047,"slug":"cve-2026-78586-elastic-kibana-denial-of-service-via-unbounded-memory-allocation","title":"Elastic Kibana denial of service via unbounded memory allocation","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.063+00:00","url":"https://junglewise.ai/threats/cve-2026-78586-elastic-kibana-denial-of-service-via-unbounded-memory-allocation"},{"cve":"CVE-2026-78584","cvss":4.3,"epss":0.0031,"slug":"cve-2026-78584-elastic-kibana-information-disclosure-in-osquery-feature","title":"Elastic Kibana information disclosure in Osquery feature","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:39.943+00:00","url":"https://junglewise.ai/threats/cve-2026-78584-elastic-kibana-information-disclosure-in-osquery-feature"},{"cve":"CVE-2026-78608","cvss":6.5,"epss":0.0038,"slug":"cve-2026-78608-elastic-kibana-missing-authorization-in-apm-integration","title":"Elastic Kibana missing authorization in APM integration","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:24.16+00:00","url":"https://junglewise.ai/threats/cve-2026-78608-elastic-kibana-missing-authorization-in-apm-integration"},{"cve":"CVE-2026-78607","cvss":5.4,"epss":0.0033,"slug":"cve-2026-78607-elastic-elasticsearch-missing-authorization-in-custom-inference","title":"Elastic Elasticsearch missing authorization in custom inference service","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:24.03+00:00","url":"https://junglewise.ai/threats/cve-2026-78607-elastic-elasticsearch-missing-authorization-in-custom-inference"},{"cve":"CVE-2026-78606","cvss":4.2,"epss":0.0023,"slug":"cve-2026-78606-elastic-kibana-incorrect-authorization-in-ai-assistant","title":"Elastic Kibana incorrect authorization in AI Assistant","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:23.887+00:00","url":"https://junglewise.ai/threats/cve-2026-78606-elastic-kibana-incorrect-authorization-in-ai-assistant"}],"vendor":{"hub":true,"name":"Elastic","slug":"elastic","homepage":"https://www.elastic.co/","description":"Elastic is a search company that builds self-managed and SaaS offerings for search, logging, security, and analytics use cases.","url":"https://junglewise.ai/threats/vendors/elastic"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":9},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":19},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":23},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":41},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2019-7609","cvss":10,"slug":"cve-2019-7609-kibana-arbitrary-code-execution","title":"Kibana Arbitrary Code Execution","severity":"critical","exploited":true,"published_at":"2022-01-10T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-7609-kibana-arbitrary-code-execution"},{"cve":"CVE-2015-1427","cvss":9.8,"slug":"cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution","title":"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution"},{"cve":"CVE-2014-3120","cvss":8.1,"slug":"cve-2014-3120-elasticsearch-remote-code-execution-vulnerability","title":"Elasticsearch Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2014-3120-elasticsearch-remote-code-execution-vulnerability"},{"cve":"CVE-2026-72649","cvss":8.8,"epss":0.0092,"slug":"cve-2026-72649-elasticsearch-machine-learning-remote-code-execution-via","title":"Elasticsearch machine learning remote code execution via deserialization","severity":"high","exploited":false,"published_at":"2026-09-01T20:17:16.853+00:00","url":"https://junglewise.ai/threats/cve-2026-72649-elasticsearch-machine-learning-remote-code-execution-via"},{"cve":"CVE-2026-72642","cvss":8.8,"epss":0.006,"slug":"cve-2026-72642-elasticsearch-out-of-range-pointer-offset-in-machine-learning","title":"Elasticsearch out-of-range pointer offset in machine learning inference","severity":"high","exploited":false,"published_at":"2026-08-13T20:17:24.673+00:00","url":"https://junglewise.ai/threats/cve-2026-72642-elasticsearch-out-of-range-pointer-offset-in-machine-learning"},{"cve":"CVE-2026-0532","cvss":8.6,"epss":0.0031,"slug":"cve-2026-0532-elastic-kibana-ssrf-and-arbitrary-file-disclosure-in-google-gemini","title":"Elastic Kibana SSRF and arbitrary file disclosure in Google Gemini connector","severity":"high","exploited":false,"published_at":"2026-01-14T11:15:50.51+00:00","url":"https://junglewise.ai/threats/cve-2026-0532-elastic-kibana-ssrf-and-arbitrary-file-disclosure-in-google-gemini"},{"cve":"CVE-2026-63137","cvss":8.3,"epss":0.005,"slug":"cve-2026-63137-elastic-kibana-privilege-escalation-in-workflows-access-control","title":"Elastic Kibana privilege escalation in Workflows access control","severity":"high","exploited":false,"published_at":"2026-09-01T20:17:15.117+00:00","url":"https://junglewise.ai/threats/cve-2026-63137-elastic-kibana-privilege-escalation-in-workflows-access-control"},{"cve":"CVE-2026-33466","cvss":8.1,"epss":0.0055,"slug":"cve-2026-33466-elastic-logstash-path-traversal-in-geoip-downloader","title":"Elastic Logstash path traversal in GeoIP downloader","severity":"high","exploited":false,"published_at":"2026-04-08T18:26:00.557+00:00","url":"https://junglewise.ai/threats/cve-2026-33466-elastic-logstash-path-traversal-in-geoip-downloader"},{"cve":"CVE-2026-82302","cvss":8.1,"epss":0.0039,"slug":"cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:29.827+00:00","url":"https://junglewise.ai/threats/cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-78583","cvss":8.1,"epss":0.0039,"slug":"cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration","title":"Elastic Kibana privilege escalation via Fleet integration validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:28.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Elastic Kibana","slug":"kibana","vulnerabilities":80,"url":"https://junglewise.ai/threats/technologies/kibana"},{"name":"Elasticsearch","slug":"elasticsearch","vulnerabilities":24,"url":"https://junglewise.ai/threats/technologies/elasticsearch"},{"name":"Elastic Cloud on Kubernetes","slug":"cloud-on-kubernetes","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cloud-on-kubernetes"},{"name":"Elastic Fleet Server","slug":"fleet-server","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/fleet-server"}]}