When running a NeuVector scan, CVE-2026-34480 was found in the elastic-apm-agent artifact (version 1.55.6) for the log4j-core dependency. Vulnerabilities: 5, HIGH: 1, MEDIUM: 3, LOW: 1, UNKNOWN: 0 File: app/libs/apm-agent-attach-1.55.6.jar:elastic-apm-agent.jar ┌──────────────────────────────────…

Hi, this is for the APM agent; which is a different product then the elastic-agent

Hi Michel, Is Elastic working on upgrading the log4j-core that's included in "apm-agent" jars that are included in elastic-agent? Does seem appropriate to report that issue in this forum... Thanks! -Jeff

Elastic APM Agent - CVE-2026-34480

Elastic Stack Elastic Agent

Ben_Turman (Ben Turman) May 18, 2026, 8:09pm 4

The same CVE is also present in elasticsearch-log4j-8.19.15.jar

Topic		Replies	Views
Elastic-apm-agent-1.33.0.jar flagged by security scan APM java	4	535	February 24, 2023
CVE-2021-45105 and CVE-2020-9488 vulnerabilities with java apm agent 1.28.4 APM java	3	1755	January 19, 2022
Request for product remediation guidance – bundled Apache Log4j vulnerabilities in Elasticsearch/Logstash Elasticsearch	1	273	May 7, 2026
Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j? Elasticsearch	1	6042	December 15, 2021
Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 Security Announcements	4	353130	January 13, 2022

Elastic APM Agent - CVE-2026-34480

Related topics