Elastic vulnerabilities
We track 86 vulnerabilities in Elastic products across 23 products. 86 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest Elastic vulnerabilities
- 7.8 High severity
Elastic Endpoint Security and Elastic Endgame…: Improper Privilege Management
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
- 7.8 High severity
A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of…
A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
- 7.5 High severity
elasticsearch: Improper Check for Unusual or Exceptional Conditions
A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
- 10.0 Critical severity
Kibana Arbitrary Code Execution Exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an a
- 9.8 Critical severity
Elasticsearch Groovy Scripting Engine Remote Code Execution Exploited
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
- 8.1 High severity
Elasticsearch Remote Code Execution Exploited
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security poli