# Elastic vulnerabilities Source: https://junglewise.ai/threats/vendors/elastic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/elastic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 166 vulnerabilities in Elastic: 0 in the last 7 days and 87 in the last 90 days, 3 of them critical and 3 exploited in the wild. The most recent, CVE-2026-115716, was published on 3 November 2026. 19 vulnerabilities in the last four weeks, down 24% on the four before (25). 6 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 19 - Last 90 days: 87 - All time: 166 (3 critical, 3 exploited in the wild) ## About Elastic Elastic is a search company that builds self-managed and SaaS offerings for search, logging, security, and analytics use cases. ## Latest Elastic vulnerabilities - [CVE-2026-115716: Elastic APM Server denial of service via oversized OTLP payloads](https://junglewise.ai/threats/cve-2026-115716-allocation-of-resources-without-limits-or-throttling-cwe-770-in) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-115715: Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-115714: Elastic Docker images certificate validation flaw in OS bundle](https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system) (high, CVSS 7.4, published 3 Nov 2026) - [CVE-2026-115710: Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in) (medium, CVSS 4.2, published 3 Nov 2026) - [CVE-2026-115298: Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-115297: Elastic Packetbeat NULL pointer dereference in AMQP parser](https://junglewise.ai/threats/cve-2026-115297-null-pointer-dereference-cwe-476-in-the-amqp-protocol-parser-in) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-115295: Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-115294: Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe) (high, CVSS 7.3, published 3 Nov 2026) - [CVE-2026-115293: Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-115292: Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-115290: Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-115289: Elastic APM Server configuration cache collision information disclosure](https://junglewise.ai/threats/cve-2026-115289-use-of-multiple-resources-with-duplicate-identifier-cwe-694-in) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-115713: Elastic Cloud Enterprise symlink attack leads to data access](https://junglewise.ai/threats/cve-2026-115713-improper-link-resolution-before-file-access-link-following-cwe) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-115712: Elastic Cloud Enterprise authorization bypass in platform settings](https://junglewise.ai/threats/cve-2026-115712-incorrect-authorization-cwe-863-in-elastic-cloud-enterprise-ece) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-115711: Elastic Cloud Enterprise credential exposure in container runtime data](https://junglewise.ai/threats/cve-2026-115711-insertion-of-sensitive-information-into-externally-accessible) (medium, CVSS 6.4, published 29 Oct 2026) - [CVE-2026-115709: Elastic Cloud Enterprise symlink attack via improper link resolution](https://junglewise.ai/threats/cve-2026-115709-improper-link-resolution-before-file-access-link-following-cwe) (high, CVSS 8.2, published 29 Oct 2026) - [CVE-2026-115708: Elastic Cloud Enterprise symlink attack authentication bypass](https://junglewise.ai/threats/cve-2026-115708-improper-link-resolution-before-file-access-link-following-cwe) (high, CVSS 7.2, published 29 Oct 2026) - [CVE-2026-115707: Elastic Cloud Enterprise certificate rotation sensitive data exposure](https://junglewise.ai/threats/cve-2026-115707-insertion-of-sensitive-information-into-externally-accessible) (medium, CVSS 6.4, published 29 Oct 2026) - [CVE-2026-115706: Elastic Cloud Enterprise authorization bypass leading to privilege escalation](https://junglewise.ai/threats/cve-2026-115706-authorization-bypass-through-user-controlled-key-cwe-639-in) (medium, CVSS 6.8, published 29 Oct 2026) - [CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-103008: Elasticsearch uncontrolled recursion denial of service in scripted runtime fields](https://junglewise.ai/threats/cve-2026-103008-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-103007: Elasticsearch incorrect authorization in delegated role management](https://junglewise.ai/threats/cve-2026-103007-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (high, CVSS 7.2, published 6 Oct 2026) - [CVE-2026-103006: Elasticsearch uncontrolled recursion in aggregation leading to denial of service](https://junglewise.ai/threats/cve-2026-103006-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-103005: Elasticsearch memory exhaustion via oversized connector description](https://junglewise.ai/threats/cve-2026-103005-memory-allocation-with-excessive-size-value-cwe-789-in) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-102413: Elastic Endpoint uncaught exception denial of service](https://junglewise.ai/threats/cve-2026-102413-uncaught-exception-cwe-248-in-elastic-endpoint-can-lead-to) (medium, CVSS 6.2, published 6 Oct 2026) ## Most severe Elastic vulnerabilities - [CVE-2019-7609: Kibana Arbitrary Code Execution](https://junglewise.ai/threats/cve-2019-7609-kibana-arbitrary-code-execution) (critical, exploited in the wild, CVSS 10, published 10 Jan 2022) - [CVE-2015-1427: Improper Access Control in Elasticsearch](https://junglewise.ai/threats/cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution) (critical, exploited in the wild, CVSS 9.8, published 14 May 2022) - [CVE-2014-3120: Elasticsearch Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2014-3120-elasticsearch-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 17 May 2022) - [CVE-2026-72649: Elasticsearch machine learning remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-72649-elasticsearch-machine-learning-remote-code-execution-via) (high, CVSS 8.8, published 1 Sep 2026) - [CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inference](https://junglewise.ai/threats/cve-2026-72642-elasticsearch-out-of-range-pointer-offset-in-machine-learning) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-102406: Kibana authorization bypass in Fleet package installation](https://junglewise.ai/threats/cve-2026-102406-authorization-bypass-through-user-controlled-key-cwe-639-in) (high, CVSS 8.8, published 6 Oct 2026) - [CVE-2026-0532: Elastic Kibana SSRF and arbitrary file disclosure in Google Gemini connector](https://junglewise.ai/threats/cve-2026-0532-elastic-kibana-ssrf-and-arbitrary-file-disclosure-in-google-gemini) (high, CVSS 8.6, published 14 Jan 2026) - [CVE-2026-63137: Elastic Kibana privilege escalation in Workflows access control](https://junglewise.ai/threats/cve-2026-63137-elastic-kibana-privilege-escalation-in-workflows-access-control) (high, CVSS 8.3, published 1 Sep 2026) - [CVE-2026-115709: Elastic Cloud Enterprise symlink attack via improper link resolution](https://junglewise.ai/threats/cve-2026-115709-improper-link-resolution-before-file-access-link-following-cwe) (high, CVSS 8.2, published 29 Oct 2026) - [CVE-2026-33466: Elastic Logstash path traversal in GeoIP downloader](https://junglewise.ai/threats/cve-2026-33466-elastic-logstash-path-traversal-in-geoip-downloader) (high, CVSS 8.1, published 8 Apr 2026) ## Vulnerabilities per week 19 vulnerabilities in the last four weeks, down 24% on the four before (25). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 41 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 11 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 14 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 7 | 0 | 0 | | 2 Nov 2026 | 12 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Elastic technologies - [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana): 93 vulnerabilities - [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch): 45 vulnerabilities - [Elastic Cloud Enterprise](https://junglewise.ai/threats/technologies/elastic-cloud-enterprise): 7 vulnerabilities - [Elastic Apm Server](https://junglewise.ai/threats/technologies/apm-server): 4 vulnerabilities - [Elastic Cloud on Kubernetes](https://junglewise.ai/threats/technologies/cloud-on-kubernetes): 4 vulnerabilities - [Elastic Fleet Server](https://junglewise.ai/threats/technologies/fleet-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Elastic vulnerabilities", https://junglewise.ai/threats/vendors/elastic, 13 November 2026.