Elastic Cloud Enterprise (ECE) vulnerabilities

2 known vulnerabilities in Elastic Cloud Enterprise (ECE) from Elastic. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Elastic Cloud Enterprise (ECE): Incorrect Authorization

  CVE-2025-37736Nov 7, 2025Elastic

  Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-ac

• 7.2 High severity

  Elastic Cloud Enterprise (ECE): Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2025-37729Oct 13, 2025Elastic

  Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variabl