Elastic Cloud Enterprise CVE-2025-37729

Exploitation requires authenticated Administrator access to Elastic Cloud Enterprise (CVSS PR:H) - the description explicitly states 'a malicious actor with Admin access.' The concrete technical prerequisite is the ability to submit a string into an ECE field that is processed by the Jinjava template engine without neutralization of template special elements, so the attacker's input is evaluated as a Jinjava expression. The primary limiting factors are: (1) the attacker must already hold ECE admin privileges, and (2) the instance must run a version prior to the fixed builds ECE 3.8.2 / 4.0.2. No user interaction is required (UI:N) and the vector is network-reachable (AV:N), but the admin requirement means there is no unauthenticated or low-privilege path.

This is a server-side template injection (SSTI, CWE-1336) in Elastic Cloud Enterprise's use of the Jinjava template engine, scored 7.2 (High) by Elastic with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The single most important mitigating signal is PR:H: the vulnerability is explicitly reachable only by 'a malicious actor with Admin access,' which drastically narrows the realistic threat population to insiders or attackers who have already compromised an administrator credential/session. Given full admin access to an orchestration platform like ECE, the incremental value of an SSTI primitive is high (it converts a configuration-level privilege into code/command execution and data exfiltration) but the precondition means this is not a mass-exploitable, internet-facing flaw. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatable mass exploitation - consistent with an admin-gated, environment-specific issue rather than a wormable one. Net: a legitimately High-severity defense-in-depth/privilege-escalation issue that should be patched on normal priority, but not an emergency drop-everything item absent any exploitation signal. Note the apparent tension between AV:N (network) and the admin-only requirement - exploitation is network-reachable but authenticated as Admin, so it is best read as a post-authentication capability rather than a remote-unauthenticated breach.

An attacker who has obtained Elastic Cloud Enterprise administrator access (malicious insider, or an outsider who phished/stole admin credentials) supplies a specially crafted string into a field that ECE passes to the Jinjava template engine. Because template special characters are not neutralized, the embedded Jinjava expressions are evaluated server-side, letting the attacker read sensitive information and issue commands on the platform. No public exploit code was identified at time of analysis, and exploitation requires the attacker to already hold Admin privileges.