CVE Tools
Track your stack

Elastic Cloud Enterprise

18 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Elastic Cloud Enterprise, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Elastic Cloud Enterprise CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Elastic Cloud Enterprise CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-101
2025-111
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-107
2026-110

Severity

How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical16%
  • High844%
  • Medium950%

Latest CVEs

The 15 most recently published vulnerabilities affecting Elastic Cloud Enterprise.

  1. CVE-2026-115713Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification7.5
  2. CVE-2026-115712Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings4.3
  3. CVE-2026-115711Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure6.4
  4. CVE-2026-115709Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss8.2
  5. CVE-2026-115708Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass7.2
  6. CVE-2026-115707Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.4
  7. CVE-2026-115706Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.8
  8. CVE-2025-37736Elastic Cloud Enterprise Improper Authorization8.8
  9. CVE-2025-37729Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine9.1
  10. CVE-2024-37282It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated p...8.1
  11. CVE-2023-31418Elasticsearch uncontrolled resource consumption7.5
  12. CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.5.3
  13. CVE-2022-23715A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log ...6.5
  14. CVE-2021-22146All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and i...7.5
  15. CVE-2018-3825In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritte...5.9

Product grouping is registry-driven, with AI assist and human review. How it works