# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=7 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 8 --- ## [Elastic Response to Blog ‘EDR 0-Day Vulnerability’](https://discuss.elastic.co/t/elastic-response-to-blog-edr-0-day-vulnerability/381093)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 1\ **Last updated:** [August 26, 2025, 7:03pm UTC](https://discuss.elastic.co/t/elastic-response-to-blog-edr-0-day-vulnerability/381093 "2025-08-26T19:03:51Z")
Updated: August 29, 2025 Elastic has been directly engaging with the independent researcher. After evaluating additional information provided by the researcher, our original assessment still stands. To confirm we are r… --- ## [APM Server (Windows Installer) 8.16.3, 8.17.1 Security Update (ESA-2025-01)](https://discuss.elastic.co/t/apm-server-windows-installer-8-16-3-8-17-1-security-update-esa-2025-01/380557)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 11:30pm UTC](https://discuss.elastic.co/t/apm-server-windows-installer-8-16-3-8-17-1-security-update-esa-2025-01/380557 "2025-07-29T23:30:19Z")
APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (ESA-2025-01) An uncontrolled search path element vulnerability can lead to local privilege Escala… --- ## [Beats (Windows Installer) 8.18.6, 8.19.3, 9.0.6, & 9.1.0 Security Update (ESA-2025-12)](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 11:32pm UTC](https://discuss.elastic.co/t/beats-windows-installer-8-18-6-8-19-3-9-0-6-9-1-0-security-update-esa-2025-12/380558 "2025-07-29T23:32:46Z")
Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (ESA-2025-12) An uncontrolled search path element vulnerability can lead to local privilege Escalation … --- ## [APM Server 8.12.1 Security Update (ESA-2024-03)](https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [February 6, 2024, 10:35pm UTC](https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688 "2024-02-06T22:35:37Z")
APM Server Insertion of Sensitive Information into Log File (ESA-2024-03) An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed a… --- ## [Kibana 8.17.3 / 8.16.6 Security Update (ESA-2025-06)](https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441 "2025-03-05T09:41:24Z")
Kibana arbitrary code execution via prototype pollution (ESA-2025-06) Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions \>… --- ## [Kibana 7.17.29, 8.17.8, 8.18.3, 9.0.3 Security Update (ESA-2025-10)](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 5:01pm UTC](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-10/379444 "2025-06-24T17:01:48Z")
Kibana Open Redirect (ESA-2025-10) URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. Affected … --- ## [Kibana 7.17.29, 8.17.8, 8.18.3, 9.0.3 Security Update (ESA-2025-09)](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-09/379443)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 5:00pm UTC](https://discuss.elastic.co/t/kibana-7-17-29-8-17-8-8-18-3-9-0-3-security-update-esa-2025-09/379443 "2025-06-24T17:00:12Z")
Kibana Heap Corruption via Crafted HTML Page due to Chromium Type Confusion (ESA-2025-09) On March 10, 2025, Google announced CVE-2025-2135, which can lead to heap corruption via a crafted HTML page through a Type Confu… --- ## [Kibana 8.12.1 Security Update (ESA-2024-21)](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 4:48pm UTC](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064 "2025-06-10T16:48:27Z")
Kibana Improper Authorization (ESA-2024-21) Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. Affected Versions: Kibana versions before and includi… --- ## [Kibana 8.16.4 and 8.17.2 Security Update (ESA-2025-02)](https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:53pm UTC](https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918 "2025-04-08T15:53:15Z")
Kibana Prototype Pollution can lead to code injection (ESA-2025-02) Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Affected Versions: Kibana version… --- ## [Kibana 8.17.6, 8.18.1, or 9.0.1 Security Update (ESA-2025-07)](https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 6, 2025, 4:29pm UTC](https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868 "2025-05-06T16:29:27Z")
Kibana arbitrary code execution via prototype pollution (ESA-2025-07) A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints… --- ## [Kibana 7.17.23/8.15.0 Security Updates (ESA-2024-32, ESA-2024-33)](https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 23, 2025, 5:52am UTC](https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548 "2025-01-23T05:52:11Z")
Kibana allocation of resources without limits or throttling leads to crash (ESA-2024-33) An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api… --- ## [Logstash 8.15.3 Security Update (ESA-2024-38)](https://discuss.elastic.co/t/logstash-8-15-3-security-update-esa-2024-38/377707)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:10am UTC](https://discuss.elastic.co/t/logstash-8-15-3-security-update-esa-2024-38/377707 "2025-05-01T10:10:01Z")
Logstash affected by CVE-2024-47561 in Apache Avro (ESA-2024-38) On October 3, 2024, CVE-2024-47561 was published, which can lead to execution of arbitrary code. The issue only affects users using the Kafka integration… --- ## [Logstash 8.17.6, 8.18.1, and 9.0.1 Security Update (ESA-2025-08)](https://discuss.elastic.co/t/logstash-8-17-6-8-18-1-and-9-0-1-security-update-esa-2025-08/377869)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 6, 2025, 4:33pm UTC](https://discuss.elastic.co/t/logstash-8-17-6-8-18-1-and-9-0-1-security-update-esa-2025-08/377869 "2025-05-06T16:33:44Z")
Logstash Improper Certificate Validation in TCP output (ESA-2025-08) Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in… --- ## [Elastic Agent / Elastic Endpoint Security Security Update (ESA-2025-03)](https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-security-security-update-esa-2025-03/377706)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:06am UTC](https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-security-security-update-esa-2025-03/377706 "2025-05-01T10:06:44Z")
Elastic Agent / Elastic Endpoint Security local API key disclosure (ESA-2025-03) Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confiden… --- ## [Kibana 7.17.24 and 8.12.0 Security Update (ESA-2024-20)](https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 11:34am UTC](https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712 "2025-05-01T11:34:47Z")
Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS (ESA-2024-20) Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via… --- ## [Elasticsearch 7.17.25 and 8.16.0 Security Update (ESA-2024-40)](https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709 "2025-05-01T10:13:22Z")
Elasticsearch Uncontrolled Resource Consumption vulnerability(ESA-2024-40) Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to De… --- ## [Kibana 7.17.19 and 8.13.0 Security Update (ESA-2024-47)](https://discuss.elastic.co/t/kibana-7-17-19-and-8-13-0-security-update-esa-2024-47/377711)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-7-17-19-and-8-13-0-security-update-esa-2024-47/377711 "2025-05-01T10:15:05Z")
Kibana Unrestricted Upload of File (ESA-2024-47) Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side… --- ## [APM Server 8.16.1 Security Update (ESA-2024-41)](https://discuss.elastic.co/t/apm-server-8-16-1-security-update-esa-2024-41/377710)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:14am UTC](https://discuss.elastic.co/t/apm-server-8-16-1-security-update-esa-2024-41/377710 "2025-05-01T10:14:04Z")
APM Server Insertion of Sensitive Information into Log File (ESA-2024-41) APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, thi… --- ## [Elastic Agent 7.17.25 and 8.15.4 Security Update (ESA-2024-39)](https://discuss.elastic.co/t/elastic-agent-7-17-25-and-8-15-4-security-update-esa-2024-39/377708)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 1, 2025, 10:11am UTC](https://discuss.elastic.co/t/elastic-agent-7-17-25-and-8-15-4-security-update-esa-2024-39/377708 "2025-05-01T10:11:54Z")
Elastic Agent Inclusion of Functionality from Untrusted Control Sphere (ESA-2024-39) Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute a… --- ## [Elasticsearch 7.17.24 and 8.15.1 Security Update (ESA-2024-37)](https://discuss.elastic.co/t/elasticsearch-7-17-24-and-8-15-1-security-update-esa-2024-37/376924)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 4:00pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-24-and-8-15-1-security-update-esa-2024-37/376924 "2025-04-08T16:00:32Z")
Elasticsearch Uncontrolled Resource Consumption vulnerability (ESA-2024-37) An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection obje… --- ## [Kibana 7.17.23 and 8.15.1 Security Update (ESA-2024-36)](https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:59pm UTC](https://discuss.elastic.co/t/kibana-7-17-23-and-8-15-1-security-update-esa-2024-36/376923 "2025-04-08T15:59:01Z")
Kibana Uncontrolled Resource Consumption vulnerability (ESA-2024-36) An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful atta… --- ## [Logstash 8.15.3, 8.16.0 Security Update (ESA-2024-48)](https://discuss.elastic.co/t/logstash-8-15-3-8-16-0-security-update-esa-2024-48/376922)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:58pm UTC](https://discuss.elastic.co/t/logstash-8-15-3-8-16-0-security-update-esa-2024-48/376922 "2025-04-08T15:58:01Z")
Logstash Inefficient Regular Expression Complexity (ESA-2024-48) On October 28th, 2024, Ruby announced CVE-2024-49761 in rexml which can lead to ReDoS when parsing XML that has many digits between &# and x...; in a hex … --- ## [Elastic Defend 8.17.3 Security Update (ESA-2025-05)](https://discuss.elastic.co/t/elastic-defend-8-17-3-security-update-esa-2025-05/376921)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:57pm UTC](https://discuss.elastic.co/t/elastic-defend-8-17-3-security-update-esa-2025-05/376921 "2025-04-08T15:57:00Z")
Elastic Defend Insertion of Sensitive Information into Log Files (ESA-2025-05) Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens vi… --- ## [Logstash 8.15.1 Security Update (ESA-2024-35)](https://discuss.elastic.co/t/logstash-8-15-1-security-update-esa-2024-35/376920)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:56pm UTC](https://discuss.elastic.co/t/logstash-8-15-1-security-update-esa-2024-35/376920 "2025-04-08T15:56:48Z")
Logstash Uncontrolled Resource Consumption vulnerability (ESA-2024-35) On August 19, 2024, Floraison announced CVE-2024-43380, which affects fugit "natural" parser. The parser turns natural language into a cron date and… --- ## [Elasticsearch 8.15.1 Security Update (ESA-2024-34)](https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 3:54pm UTC](https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919 "2025-04-08T15:54:09Z")
Elasticsearch Uncontrolled Resource Consumption vulnerability (ESA-2024-34) A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class coul… --- ## [Kibana 8.14.0/7.17.22 Security Update (ESA-2024-11)](https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update-esa-2024-11/361460)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [June 14, 2024, 4:47am UTC](https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update-esa-2024-11/361460 "2024-06-14T04:47:49Z")
Kibana uncontrolled resource consumption (ESA-2024-11) A high-privileged user, allowed to create custom osquery packs could affect the availability of Kibana by uploading a maliciously crafted osquery pack. Affected Ver… --- ## [Kibana 8.15.1 Security Update (ESA-2024-27, ESA-2024-28)](https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 5, 2024, 7:19pm UTC](https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119 "2024-09-05T19:19:30Z")
Kibana arbitrary code execution via YAML deserialization in Amazon Bedrock Connector (ESA-2024-27) A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con… --- ## [Fleet Server 8.15.0 Security Update ( ESA-2024-31)](https://discuss.elastic.co/t/fleet-server-8-15-0-security-update-esa-2024-31/373522)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 22, 2025, 3:09pm UTC](https://discuss.elastic.co/t/fleet-server-8-15-0-security-update-esa-2024-31/373522 "2025-01-22T15:09:01Z")
Fleet Server sensitive information exposure via logs (ESA-2024-31) An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The natur… --- ## [Kibana 8.15.0 Security Update (ESA-2024-29, ESA-2024-30)](https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 22, 2025, 3:04pm UTC](https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521 "2025-01-22T15:04:36Z")
Kibana server-side request forgery (ESA-2024-29) A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health\_check API could be used to send requests to internal endpoints. Due to the… --- ## [Kibana 7.17.23 and 8.14.2 Security Update (ESA-2024-26)](https://discuss.elastic.co/t/kibana-7-17-23-and-8-14-2-security-update-esa-2024-26/373443)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 21, 2025, 10:50am UTC](https://discuss.elastic.co/t/kibana-7-17-23-and-8-14-2-security-update-esa-2024-26/373443 "2025-01-21T10:50:17Z")
Kibana allocation of resources without limits or throttling leads to crash (ESA-2024-26) An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /a… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=6) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=8)