Sign inStart freeBook a demo

Elastic vulnerabilities2 known to be exploited.

Vendor2 known exploited
The short answer

Elastic has 185 published vulnerabilities across 30 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Kibana, with 80. If you run Elastic software, patch the exploited flaws first.

See the exploited flaws

The most recent Elastic flaw added to the known-exploited list is CVE-2015-1427, on 25 March 2022. We keep watching the known-exploited list.

Products

Which Elastic products have the most vulnerabilities?

Kibana leads with 80 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.

  1. Kibana80
  2. Elasticsearch42
  3. Logstash12
  4. X-Pack9
  5. Elastic Cloud Enterprise6
  6. Enterprise Search5
  7. Elastic Agent5
  8. Endpoint Security5
  9. Apm Server4
  10. Apm Agent3
Published vulnerabilities
Known exploited

Which Elastic vulnerabilities are being exploited?

2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.

  1. 9.8
    CVE-2015-1427CriticalKnown exploited
    Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

    The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

    Chance of use>99%Known exploited since25 Mar 2022
  2. 10.0
    CVE-2019-7609CriticalKnown exploited
    Kibana Arbitrary Code Execution

    Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

    Chance of use95%Known exploited since10 Jan 2022
Exploit likelihood

Which Elastic flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. >99%
    CVE-2015-1427CriticalKnown exploited

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    CVSS9.8Published17 Feb 2015
  2. 95%
    CVE-2019-7609CriticalKnown exploited

    Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.

    CVSS10.0Published25 Mar 2019
  3. 82%
    CVE-2018-17246Critical

    Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.

    CVSS9.8Published20 Dec 2018
  4. 76%
    CVE-2021-22145Medium

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.

    CVSS6.5Published21 Jul 2021
  5. 62%
    CVE-2023-31419Medium

    A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

    CVSS6.5Published26 Oct 2023
  6. 36%
    CVE-2021-22146High

    All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.

    CVSS7.5Published21 Jul 2021
  7. 22%
    CVE-2025-25014Critical

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    CVSS9.1Published6 May 2025
  8. 18%
    CVE-2020-7012High

    Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant.

    CVSS8.8Published3 Jun 2020
  9. 14%
    CVE-2015-5377Critical

    Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.

    CVSS9.8Published6 Mar 2018
  10. 7.5%
    CVE-2022-23712High

    A Denial of Service flaw was discovered in Elasticsearch.

    CVSS7.5Published6 Jun 2022
Every product

All Elastic products we track.

30 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.

Precursor Intelligence

Running Elastic? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

Our catalogue lists 185 published vulnerabilities across 30 products and 2,033 versions from Elastic. The most recent Elastic flaw added to the known-exploited list is CVE-2015-1427, on 25 March 2022.

2 Elastic vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2015-1427 and CVE-2019-7609. The full list is on this page.

Kibana, with 80 published vulnerabilities. Its own page lists the ones known to be exploited.

Create a Precursor Intelligence account and track the Elastic products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

Keep exploring