Elastic APM Agent - CVE-2026-34480

Elastic Stack Elastic Agent
1

When running a NeuVector scan, CVE-2026-34480 was found in the elastic-apm-agent artifact (version 1.55.6) for the log4j-core dependency.

Vulnerabilities: 5, HIGH: 1, MEDIUM: 3, LOW: 1, UNKNOWN: 0
File: app/libs/apm-agent-attach-1.55.6.jar:elastic-apm-agent.jar
┌─────────────────────────────────────┬────────────────┬──────────┬─────────┬───────────────┬────────────┐
│ PACKAGE │ VULNERABILITY │ SEVERITY │ VERSION │ FIXED VERSION │ PUBLISHED │
├─────────────────────────────────────┼────────────────┼──────────┼─────────┼───────────────┼────────────┤
│ org.apache.logging.log4j:log4j-core │ CVE-2026-34480 │ High │ 2.12.4 │ 2.25.4 │ 2026-04-10 │
│ ├────────────────┼──────────┤ ├───────────────┼────────────┤
│ │ CVE-2025-68161 │ Medium │ │ 2.25.3 │ 2025-12-18 │
│ ├────────────────┤ │ ├───────────────┼────────────┤
│ │ CVE-2026-34477 │ │ │ 2.25.4 │ 2026-04-10 │
└─────────────────────────────────────┴────────────────┴──────────┴─────────┴───────────────┴────────────┘

2

Hi, this is for the APM agent; which is a different product then the elastic-agent