# Elastic APM Agent - CVE-2026-34480

**URL:** <https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100>\
**Category:** Elastic Agent\
**Created:** [April 29, 2026, 10:06pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100 "2026-04-29T22:06:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![leoluzh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leoluzh/32/147468_2.png) [@leoluzh](https://discuss.elastic.co/u/leoluzh)\
**Post date:** [April 29, 2026, 10:06pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100/1 "2026-04-29T22:06:45Z")

</div>

When running a **NeuVector scan** , **CVE-2026-34480** was found in the **elastic-apm-agent** artifact (version **1.55.6** ) for the **log4j-core** dependency.

Vulnerabilities: 5, HIGH: 1, MEDIUM: 3, LOW: 1, UNKNOWN: 0  
File: app/libs/apm-agent-attach-1.55.6.jar:elastic-apm-agent.jar  
┌─────────────────────────────────────┬────────────────┬──────────┬─────────┬───────────────┬────────────┐  
│ PACKAGE │ VULNERABILITY │ SEVERITY │ VERSION │ FIXED VERSION │ PUBLISHED │  
├─────────────────────────────────────┼────────────────┼──────────┼─────────┼───────────────┼────────────┤  
│ org.apache.logging.log4j:log4j-core │ CVE-2026-34480 │ High │ 2.12.4 │ 2.25.4 │ 2026-04-10 │  
│ ├────────────────┼──────────┤ ├───────────────┼────────────┤  
│ │ CVE-2025-68161 │ Medium │ │ 2.25.3 │ 2025-12-18 │  
│ ├────────────────┤ │ ├───────────────┼────────────┤  
│ │ CVE-2026-34477 │ │ │ 2.25.4 │ 2026-04-10 │  
└─────────────────────────────────────┴────────────────┴──────────┴─────────┴───────────────┴────────────┘

---

<div class="post-metadata">

**Author:** ![MichelLaterman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michellaterman/32/110221_2.png) [@MichelLaterman](https://discuss.elastic.co/u/MichelLaterman)\
**Post date:** [April 30, 2026, 9:43pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100/2 "2026-04-30T21:43:44Z")

</div>

Hi, this is for the APM agent; which is a different product then the elastic-agent

---

<div class="post-metadata">

**Author:** ![JeffP](https://avatars.discourse-cdn.com/v4/letter/j/e495f1/32.png) [@JeffP](https://discuss.elastic.co/u/JeffP)\
**Post date:** [May 15, 2026, 9:38pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100/3 "2026-05-15T21:38:02Z")

</div>

Hi Michel,

Is Elastic working on upgrading the log4j-core that's included in "apm-agent" jars that are included in elastic-agent? Does seem appropriate to report that issue in this forum...

Thanks!

-Jeff

---

<div class="post-metadata">

**Author:** ![Ben\_Turman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben_turman/32/144071_2.png) [@Ben\_Turman](https://discuss.elastic.co/u/Ben_Turman)\
**Post date:** [May 18, 2026, 8:09pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100/4 "2026-05-18T20:09:52Z")

</div>

The same CVE is also present in elasticsearch-log4j-8.19.15.jar