Elastic Maps Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-238)

Out-of-bounds Write in Elastic Maps Server Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder used by the Node.js runtime, a dependency of Elastic Maps Server Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to corrupt memory and...

Multiple Elastic Docker images 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-237)

Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the operating system certificate bundle shipped in the Docker images of APM Server Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat Elastic Agent...

APM Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-236)

Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP da...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-235)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of t...

Elastic Agent 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-234)

Out-of-bounds Write in Elastic Agent Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Elastic Agent Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or...

Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-233)

Out-of-bounds Write in Heartbeat Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Heartbeat Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to cause a crash, disclose process memory, or potentially...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-232)

Out-of-bounds Write in Kibana Leading to Remote Code Execution Out-of-bounds Write CWE-787 in the Brotli decoder of Node.js, a dependency of Kibana Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to corrupt memory and potentially execute code in the Kibana server...

Elastic Agent “Complete Flavor” (Synthetics) 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-231)

Improper Certificate Validation in Elastic Agent Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Node.js runtime bundled with the Elastic Agent “Complete Flavor” Docker images that include Synthetics, a dependency of Elastic Agent “Complete Flavor”...

Heartbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-230)

Improper Certificate Validation in Heartbeat Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Node.js runtime bundled with the Heartbeat Docker image, a dependency of Heartbeat Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attack...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-229)

Improper Certificate Validation in Kibana Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Node.js runtime bundled with Kibana, a dependency of Kibana Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to intercept or modify...

Logstash 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-228)

Improper Certificate Validation in Logstash Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Java runtime bundled with Logstash, a dependency of Logstash Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to intercept or modi...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-227)

Improper Certificate Validation in Elasticsearch Leading to Interception of TLS Connections Improper Certificate Validation CWE-295 in the Java runtime bundled with Elasticsearch, a dependency of Elasticsearch Dependency on Vulnerable Third-Party Component, CWE-1395, could allow an attacker to...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-210)

Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types,...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-209)

Incorrect Authorization in Elasticsearch Leading to Information Disclosure Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-leve...

Packetbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-208)

NULL Pointer Dereference in Packetbeat Leading to Denial of Service NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-206)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read...

Kibana 9.4.9, 9.5.6 Security Update (ESA-2026-205)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-204)

Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure Insertion of Sensitive Information Into Sent Data CWE-201 in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials...

Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-203)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticate...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node c...

APM Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-200)

Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure Use of Multiple Resources with Duplicate Identifier CWE-694 in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could...

Elastic Cloud Enterprise (ECE) 4.2.1 Security Update (ESA-2026-222)

Improper Link Resolution Before File Access 'Link Following' in Elastic Cloud Enterprise ECE Leading to Information Disclosure and Data Modification Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to unauthorized read and write access t...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-221)

Incorrect Authorization in Elastic Cloud Enterprise ECE Leading to Unauthorized Modification of Platform Settings Incorrect Authorization CWE-863 in Elastic Cloud Enterprise ECE can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained b...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-218)

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise ECE Leading to Credential Disclosure Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-538 in Elastic Cloud Enterprise ECE can lead to credential disclosur...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-216)

Improper Link Resolution Before File Access 'Link Following' in Elastic Cloud Enterprise ECE Leading to Information Disclosure and Data Loss Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to unauthorized disclosure and loss of data...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-215)

Improper Link Resolution Before File Access 'Link Following' in Elastic Cloud Enterprise ECE Leading to Authentication Bypass Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise ECE Leading to Privilege Escalation Insertion of Sensitive Information into Externally-Accessible File or Directory CWE-538 in Elastic Cloud Enterprise ECE can lead to privilege escalation...

Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-211)

Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise ECE Leading to Privilege Escalation Authorization Bypass Through User-Controlled Key CWE-639 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Privilege Abuse CAPEC-122. An attacker who controls any ho...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized sha...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect...

Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursio...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with connector management privileges could cause t...

Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)

Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception CWE-248 in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-suppli...

Kibana 9.4.0 Security Update (ESA-2026-191)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a...

Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130. Affected Versions: 9.x:...

Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-188)

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient...

Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-185)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can submit a specially crafted query that causes...

Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions fr...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions fr...

Elasticsearch 9.4.7, 9.5.4 Security Update (ESA-2026-182)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.4.6 All versions from 9.5....

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-181)

Uncontrolled Resource Consumption in Kibana Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-180)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions fr...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-179)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.12.0 up to and including 8.19.21 9.x: All versions...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-176)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All version...

Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: All version...