12 Elastic Security Vulnerabilities Patched Across Stack
TL;DR
Elastic released new security updates on November 3, 2026. The advisories fix 12 Elastic security vulnerabilities across Elasticsearch, Kibana, APM Server, and Beats. These flaws allow traffic snooping, denial of service, and resource deletion. Therefore, system admins must install the newest updates right away. They must protect their data clusters from harm. They should keep their systems safe.
Why It Matters
The Elastic Stack powers data search, log analysis, and security tasks worldwide. Industry data shows that thousands of firms run Elasticsearch today. In fact, over 50 percent of the Fortune 500 use it daily. Teams store vital business records and security logs in these systems. Consequently, weaknesses in core cluster nodes create serious risks for business networks. Intruders can steal key data or knock services offline.
Fortunately, Elastic confirmed that no active exploitation in the wild has occurred. Furthermore, researchers have published no public exploit code for these bugs.
How the Attack Works
The security bulletins outline multiple flaws in transport security, memory handling, and access controls.
Compromised Root Certificates in Docker Images
First, CVE-2026-115714 impacts certificate stores in official Elastic Docker images. The advisory explains: “The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised.” In turn, attackers holding these keys can issue spoofed certificates. If an attacker sits in the network path, they can read or alter TLS traffic between services.
Denial of Service in Elasticsearch and APM
Second, several bugs cause denial of service through memory leaks and recursion. In Elasticsearch, CVE-2026-115290 lets unauthenticated attackers send nested payloads to the cluster port. The advisory warns: “An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate.” Similarly, CVE-2026-115716 lets attackers exhaust APM Server memory. Meanwhile, Packetbeat bug CVE-2026-115297 triggers a crash upon reading bad AMQP traffic.
Path Traversal and Credential Exposure in Kibana
Third, Kibana contains path traversal and permission bypass flaws. Under CVE-2026-115294, a path bug in Fleet agent policies allows unauthorized resource deletion. As the advisory states: “A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources.” This flaw lets attackers delete entire Kibana spaces. Additionally, CVE-2026-115293 leaks Elasticsearch service credentials during onboarding.
Affected Versions
These Elastic security vulnerabilities affect versions 8.x through 8.19.23, 9.0.0 through 9.4.8, and 9.5.0 through 9.5.5.
Patch and Mitigation Steps
Elastic resolved all 12 vulnerabilities in its latest maintenance releases. Admins should review the official Elastic security announcements forum for complete upgrade details. Teams should update their deployments to version 8.19.24, 9.4.9, or 9.5.6 immediately. In addition, teams must pull the newest Docker images to replace bad root certificates. Admins should also block untrusted access to remote cluster ports. They should restrict network access to internal subnets.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
