# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=7 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 8 --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-31)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-31/384179)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:16pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-31/384179 "2025-12-18T21:16:04Z")
Packetbeat Out-of-bounds Read (ESA-2025-31) Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service … --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-30)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:15pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178 "2025-12-18T21:15:08Z")
Packetbeat Improper Bounds Check (ESA-2025-30) Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cau… --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-29)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:13pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177 "2025-12-18T21:13:38Z")
Packetbeat Allocation of Resources Without Limits or Throttling (ESA-2025-29) Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC… --- ## [Kibana 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-28)](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064 "2025-12-15T10:15:09Z")
Kibana Cross-site Scripting via the Integration Package Upload Functionality (ESA-2025-28) Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to re… --- ## [Elasticsearch 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-27)](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063 "2025-12-15T10:14:49Z")
Elasticsearch Improper Authentication (ESA-2025-27) Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a… --- ## [Kibana 8.19.7, 9.1.7, and 9.2.1 Security Update (ESA-2025-24)](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381 "2025-11-12T09:41:39Z")
Kibana Origin Validation Error (ESA-2025-24) Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Affected Versions: 8… --- ## [Kibana 8.19.7, 9.1.7, 9.2.1 Security Update (ESA-2025-25)](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-9-2-1-security-update-esa-2025-25/383379)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 9:33am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-9-2-1-security-update-esa-2025-25/383379 "2025-11-12T09:33:52Z")
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (ESA-2025-25) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kibana can lead to DOM-ba… --- ## [Elastic Defend 8.19.6, 9.1.6, and 9.2.0 Security Update (ESA-2025-23)](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [November 6, 2025, 2:25pm UTC](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272 "2025-11-06T14:25:08Z")
Elastic Defend Improper Preservation of Permissions (ESA-2025-23) Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service run… --- ## [Elastic Cloud Enterprise (ECE) 3.8.3 and 4.0.3 Security Update (ESA-2025-22)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 31, 2025, 5:36pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132 "2025-10-31T17:36:53Z")
Elastic Cloud Enterprise Improper Authorization (ESA-2025-22) Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed… --- ## [🎉 What’s new in Elastic 9.2](https://discuss.elastic.co/t/what-s-new-in-elastic-9-2/383071)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 11:25am UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-2/383071 "2025-10-29T11:25:38Z")
:tada: What’s new in Elastic 9.2 Learn about Elastic 9.2 with Agent Builder, DiskBBQ, Streams, Significant Events, and more. Note that some of those new features are in tech preview and hidden by default but there a… --- ## [Elastic Cloud Enterprise (ECE) 3.8.2 and 4.0.2 Security Update (ESA-2025-21)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 13, 2025, 1:44pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641 "2025-10-13T13:44:01Z")
Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine (ESA-2025-21) Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) … --- ## [Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5 Security Update (ESA-2025-20)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:20pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449 "2025-10-06T16:20:21Z")
Kibana Cross-Site Scripting (XSS) (ESA-2025-20) Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. Affected Versions: 7.x: All versions prior to and inc… --- ## [Kibana - Crowdstrike Connector 8.18.8, 8.19.5, 9.0.8, and 9.1.5 Security Update (ESA-2025-19)](https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:44pm UTC](https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455 "2025-10-06T16:44:50Z")
Kibana Insufficiently Protected Credentials in the CrowdStrike Connector (ESA-2025-19) Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user… --- ## [Elasticsearch 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-18)](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453 "2025-10-06T16:40:57Z")
Elasticsearch Insertion of sensitive information in log file (ESA-2025-18) Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing r… --- ## [Kibana 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-17)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:29pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451 "2025-10-06T16:29:00Z")
Kibana Stored Cross-Site-Scripting(XSS) (ESA-2025-17) Improper Validation of Specified Type of Input in Kibana can lead to stored Cross-Site-Scripting (XSS) Affected Versions: 7.x: All versions from 7.0.0 and up to a… --- ## [Kibana 8.18.8, 8.19.4, 9.0.7, 9.1.4 Security Update (ESA-2025-16)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:24pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450 "2025-10-06T16:24:59Z")
Kibana Cross-Site-Scripting (XSS) (ESA-2025-16) Improper Neutralization of Input During Web Page Generation in Vega visualizations in Kibana can lead to Cross-Site-Scripting (XSS) Affected Versions: 7.x: All versions… --- ## [Enterprise Search 8.18.6, 8.19.3 Security Update (ESA-2025-15) (CVE-2025-54988)](https://discuss.elastic.co/t/enterprise-search-8-18-6-8-19-3-security-update-esa-2025-15-cve-2025-54988/381428)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:39pm UTC](https://discuss.elastic.co/t/enterprise-search-8-18-6-8-19-3-security-update-esa-2025-15-cve-2025-54988/381428 "2025-08-28T15:39:46Z")
Enterprise Search XML external entity (XXE) injection in Apache Tika (ESA-2025-15) On August 20, 2025, CVE-2025-54988 in Apache Tika PDF parser module was announced, disclosing an XML External Entity injection flaw in t… --- ## [Elasticsearch 8.18.6, 8.19.3, 9.0.6, and 9.1.3 Security Update (ESA-2025-14) (CVE-2025-54988)](https://discuss.elastic.co/t/elasticsearch-8-18-6-8-19-3-9-0-6-and-9-1-3-security-update-esa-2025-14-cve-2025-54988/381427)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:38pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-6-8-19-3-9-0-6-and-9-1-3-security-update-esa-2025-14-cve-2025-54988/381427 "2025-08-28T15:38:52Z")
Elasticsearch XML external entity (XXE) injection in Apache Tika (ESA-2025-14) On August 20, 2025, CVE-2025-54988 in Apache Tika PDF parser module was announced, disclosing an XML External Entity injection flaw in the A… --- ## [Kibana 9.0.6, 9.1.3 Security Update (ESA-2025-13)](https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:35pm UTC](https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426 "2025-08-28T15:35:08Z")
Kibana privilege escalation via reporting\_user role (ESA-2025-13) Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting\_user role which incorrectly has the ability to access all K… --- ## [Elastic Response to Blog ‘EDR 0-Day Vulnerability’](https://discuss.elastic.co/t/elastic-response-to-blog-edr-0-day-vulnerability/381093)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 1\ **Last updated:** [August 26, 2025, 7:03pm UTC](https://discuss.elastic.co/t/elastic-response-to-blog-edr-0-day-vulnerability/381093 "2025-08-26T19:03:51Z")
Updated: August 29, 2025 Elastic has been directly engaging with the independent researcher. After evaluating additional information provided by the researcher, our original assessment still stands. To confirm we are r… --- ## [\[New\] DevTools in VSCode Elasticsearch Extension (and more)](https://discuss.elastic.co/t/new-devtools-in-vscode-elasticsearch-extension-and-more/381241)
**Author:** [@Itamar\_Syn-Hershko](https://discuss.elastic.co/u/Itamar_Syn-Hershko)\ **Replies:** 1\ **Last updated:** [August 22, 2025, 12:05pm UTC](https://discuss.elastic.co/t/new-devtools-in-vscode-elasticsearch-extension-and-more/381241 "2025-08-22T12:05:54Z")
We released a new VS Code extension, especially for engineers building with Elasticsearch; or looking for easier way to maintain Elasticsearch in production. This extension brings a supercharged Kibana DevTools-like fun… --- ## [APM Server (Windows Installer) 8.16.3, 8.17.1 Security Update (ESA-2025-01)](https://discuss.elastic.co/t/apm-server-windows-installer-8-16-3-8-17-1-security-update-esa-2025-01/380557)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 11:30pm UTC](https://discuss.elastic.co/t/apm-server-windows-installer-8-16-3-8-17-1-security-update-esa-2025-01/380557 "2025-07-29T23:30:19Z")
APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (ESA-2025-01) An uncontrolled search path element vulnerability can lead to local privilege Escala… --- ## [Beats (Windows Installer) 8.18.6, 8.19.3, 9.0.6, & 9.1.0 Security Update (ESA-2025-12)](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 11:32pm UTC](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558 "2025-07-29T23:32:46Z")
Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (ESA-2025-12) An uncontrolled search path element vulnerability can lead to local privilege Escalation … --- ## [APM Server 8.12.1 Security Update (ESA-2024-03)](https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [February 6, 2024, 10:35pm UTC](https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688 "2024-02-06T22:35:37Z")
APM Server Insertion of Sensitive Information into Log File (ESA-2024-03) An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed a… --- ## [🎉 What’s new in Elastic 8.19/9.1](https://discuss.elastic.co/t/what-s-new-in-elastic-8-19-9-1/380552)
**Author:** [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 4:37pm UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-8-19-9-1/380552 "2025-07-29T16:37:13Z")
:tada: What’s new in Elastic 8.19/9.1 Elastic 9.1 and 8.19 are here! We have extended the 8.x series one final time to 8.19, so those who are still waiting to upgrade to 9.x can already benefit from the new features in 9… --- ## [Kibana 8.17.3 / 8.16.6 Security Update (ESA-2025-06)](https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441 "2025-03-05T09:41:24Z")
Kibana arbitrary code execution via prototype pollution (ESA-2025-06) Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions \>… --- ## [Share your feedback & help improve the Elastic Documentation!](https://discuss.elastic.co/t/share-your-feedback-help-improve-the-elastic-documentation/379812)
**Author:** [@Elizabeth\_ML](https://discuss.elastic.co/u/Elizabeth_ML)\ **Replies:** 0\ **Last updated:** [July 4, 2025, 1:17pm UTC](https://discuss.elastic.co/t/share-your-feedback-help-improve-the-elastic-documentation/379812 "2025-07-04T13:17:35Z")
Hi folks! I'm Elizabeth, a User Experience (UX) Researcher at Elastic. We're looking for users that frequently use or recently have used the Elastic Documentation to share their experience with us -- we want your unfil… --- ## [Kibana 7.17.29, 8.17.8, 8.18.3, 9.0.3 Security Update (ESA-2025-10)](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 5:01pm UTC](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444 "2025-06-24T17:01:48Z")
Kibana Open Redirect (ESA-2025-10) URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. Affected … --- ## [Kibana 7.17.29, 8.17.8, 8.18.3, 9.0.3 Security Update (ESA-2025-09)](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-09/379443)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 5:00pm UTC](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-09/379443 "2025-06-24T17:00:12Z")
Kibana Heap Corruption via Crafted HTML Page due to Chromium Type Confusion (ESA-2025-09) On March 10, 2025, Google announced CVE-2025-2135, which can lead to heap corruption via a crafted HTML page through a Type Confu… --- ## [\[ANNOUNCEMENT\] - Elasticsearch Beyonder 9.0 released](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-9-0-released/379098)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 2:28pm UTC](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-9-0-released/379098 "2025-06-11T14:28:52Z")
The Elasticsearch Beyonder team is pleased to announce the elasticsearch-beyonder-9.0 release! Elasticsearch beyonder provides automatic index, mapping, alias, template creation, index lifecycle policies and data when … [Previous page](https://discuss.elastic.co/c/announcements/5.md?page=6) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=8)