50
CVEs
1
Critical
10
High
0
KEV
2
PoC
10
Unpatched C/H
10.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
10
MEDIUM
37
LOW
2
Monthly CVE Trend
Affected Products (30)
Kibana
166
Elasticsearch
77
Cloud Foundry Elastic Runtime
23
Elastic Services Controller
19
Logstash
13
Java
11
Cloud Foundry Uaa
11
Open Redirect
10
Redis
9
Peoplesoft Enterprise Peopletools
9
Amazon
9
X Pack
9
Python
8
Elastic Cloud Enterprise
8
Cf Release
8
Kubernetes
8
Cloud Foundry
7
Elastic Agent
6
Cloud Foundry Uaa Bosh
6
Elastic Storage Server
6
Cloud Foundry Ops Manager
5
Enterprise Search
5
Opensearch
5
Fleet Server
5
Openshift Container Platform
5
Node.js
4
Docker
4
Communications Cloud Native Core Automated Test Suite
4
Apm Server
4
Eck Operator
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54511 | Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis. | HIGH | 8.6 | 0.3% | 63 |
PoC
|
| CVE-2026-89261 | Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier. | MEDIUM | 6.9 | 0.5% | 54 |
PoC
No patch
|
| CVE-2026-73579 | We need answer JSON only. Need analyze. Need ensure every field string. data_quality_flags array of objects maybe empty. Need extract. Let's inspect input. CVE-2026-73579 Apache Syncope incorrect authorization. Description. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-863. Tags: Authentication Bypass, Apache, Elastic. SSVC exploitation none automatable yes technical impact total. ENISA. References lists advisory. Need product_name 1-3 words: Apache Syncope. summary original. technical_context. risk_assessment. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss40_vector. Need be careful: "Reported by security@apache.org". Tags include Elastic maybe because search backend? Authentication Bypass. Need use all data. KEV not present, POC not explicit. Need not mention POC as public. EPSS not provided. Could say EPSS not available. CVSS provided NVD? but references nvd none? We can reference. Need assess CVSS ourselves. Description says incorrect authorization: non-recursive search requests possible Realms filter rendered empty, voiding restrictions on requester privileges. This is an authorization bypass allowing search results beyond permissions. CVSS from input 9.8: AV:N AC:L PR:N UI:N. But is it truly PR:N? Description says "requester's permissions" maybe authenticated user? Search requests likely authenticated? Let's investigate. Apache Syncope is identity management. Any search requests are transformed... Realms filter ensures results matching requester's permissions. For non-recursive search requests possible filter empty. Attack vector network. Does exploit require authentication? If any requester? Incorrect authorization could be authenticated low privilege. But input CVSS has PR:N. We must not contradict maybe assess. Need "CVSS vector (attack vector, complexity, privileges)" compare. We can note CVSS says unauthent | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-72649 | Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deployment privileges to execute arbitrary attacker-controlled logic on the Elasticsearch host node by supplying a crafted trained model artifact. The flaw stems from unsafe deserialization (CWE-502) of model artifact data during the ML inference loading process, granting the attacker a broader OS system-call surface than the ML subsystem is intended to expose. Elastic has released fixed versions 8.19.2, 9.4.5, and 9.5.1 via ESA-2026-114; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-90772 | Stored cross-site scripting in Amundsen Frontend through 4.3.0 allows authenticated users with description-write access to inject arbitrary JavaScript into table, dashboard, and feature description fields, executing attacker-controlled code in the browser of every user who subsequently views search results. The root cause is React's dangerouslySetInnerHTML used without any HTML sanitization in ResourceListItem components (TableListItem and siblings), meaning payloads such as img elements with onerror handlers stored via the metadata service or Elasticsearch persist and fire on each page load. No public exploit code has been identified at time of analysis, but the attack pattern is elementary for anyone with metadata write access. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-63137 | Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release. | HIGH | 8.3 | 0.3% | 42 |
No patch
|
| CVE-2026-78583 | Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-82302 | Incorrect authorization (CWE-863) in Elastic Kibana allows authenticated users holding only low-privilege accounts to modify configurations that should be restricted to higher-privilege roles, bypassing Kibana's access control enforcement. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N) confirms the flaw is network-exploitable with minimal complexity and yields high confidentiality and integrity impact against Kibana's configuration plane. Elastic has released patched versions across the 8.x and 9.x release trains under advisory ESA-2026-178; no public exploit has been identified and the vulnerability is not listed in CISA KEV. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-78604 | Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-78592 | Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments. | HIGH | 7.3 | 0.2% | 37 |
No patch
|
| CVE-2026-78590 | Path traversal in Kibana's Fleet feature enables a low-privileged attacker with Fleet Settings write access to plant a malicious pathname in settings that, when subsequently acted upon by an administrator, causes deletion of privileged internal resources including user accounts and organizational assets. All Kibana versions prior to 8.19.18, 9.3.6, and 9.4.3 are affected per ESA-2026-158. No public exploit code or active exploitation has been confirmed; the two-party nature of the attack - requiring both attacker write access and administrator interaction - moderates opportunistic exploitability despite the High CVSS rating. | HIGH | 7.3 | 0.3% | 36 |
No patch
|
| CVE-2026-78607 | Missing authorization in Elasticsearch's custom inference service allows a low-privileged user holding only inference execution rights to redirect outbound inference traffic to an attacker-controlled endpoint, causing administrator-provisioned credentials to leak to that destination. Affected across the 8.x and 9.x branches (Elasticsearch 8.0.0 through 8.19.18, 9.0.0 through 9.3.7, 9.4.0 through 9.4.3, and 9.5.0), this is a privilege-abuse path where an underprivileged internal user effectively hijacks admin-level secrets without requiring elevated permissions. No public exploit or active exploitation has been identified; EPSS sits at 0.17% and SSVC rates technical impact as partial. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-72654 | Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-78588 | Memory exhaustion denial of service in Filebeat's HTTP ingestion endpoint allows an authenticated low-privileged attacker to crash the Filebeat process by sending specially crafted compressed payloads that trigger unbounded decompression (a decompression-bomb / zip-bomb pattern). Affected versions span the 8.x and 9.x branches, with patched releases 8.19.18 and 9.3.1 published under Elastic Security Advisory ESA-2026-165. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to attackers who can reach the HTTP input endpoint. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-78608 | Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|