CERT-FR: multiple vulnerabilities in Elastic Stack products fixed in 8.19.24, 9.4.9 and 9.5.6
CERT-FR bulletin CERTFR-2026-AVI-1461 covers multiple vulnerabilities in Elastic products. They were fixed in several Elastic security advisories (ESA-2026 series, numbered between 200 and 238) published on 3 November 2026 (discuss.elastic.co thread IDs 391355 to 391375). CERT-FR says they allow remote code execution, remote denial of service, and loss of data confidentiality and integrity. The bulletin lists 16 CVEs. It does not say which CVE maps to which product or impact, and it does not mention exploitation in the wild. The Elastic advisories themselves were not opened in this analysis, so CVSS scores, prerequisites and per-CVE details are unverified.
Entenda a falha
A vulnerabilidade
CERT-FR bulletin CERTFR-2026-AVI-1461 covers 16 CVEs (CVE-2026-111497, CVE-2026-114406, CVE-2026-114820, CVE-2026-115289, CVE-2026-115290, CVE-2026-115292 to CVE-2026-115295, CVE-2026-115297, CVE-2026-115298, CVE-2026-115710, CVE-2026-115714 to CVE-2026-115716 and CVE-2026-91403) in the Elastic Stack. CERT-FR says that, taken together, they allow remote code execution, remote denial of service, and loss of data confidentiality and integrity. The bulletin does not map each CVE to a product or impact, and gives no CVSS scores or prerequisites such as authentication or configuration. Affected products are APM Server, Elastic Agent, Docker images, Maps Server, Elasticsearch, Heartbeat, Kibana, Logstash and Packetbeat in 8.x before 8.19.24, 9.x before 9.4.9 and 9.5.x before 9.5.6. These versions are the fixed releases.
Como foi descoberta
The sources do not say who found the flaws or how. According to CERT-FR, Elastic fixed them in a series of security advisories (ESA-2026-200 to ESA-2026-238) published on 3 November 2026, and CERT-FR issued its bulletin the next day. The bulletin does not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:26.
Detalhes técnicos
Affected components are APM Server, Elastic Agent, Elastic Docker Images, Elastic Maps Server, Elasticsearch, Heartbeat, Kibana, Logstash and Packetbeat. The affected versions are 8.x before 8.19.24, 9.x before 9.4.9, and 9.5.x before 9.5.6 (cert.cyber.gouv.fr). The advisories include several for Kibana and several for Elasticsearch. They also include Elastic Agent (including the complete flavor with Synthetics), Heartbeat, Logstash, Packetbeat, APM Server, Docker images and Maps Server (cert.cyber.gouv.fr).
Remediação
Upgrade to 8.19.24, 9.4.9 or 9.5.6, depending on the branch in use. Fixes are listed in the individual Elastic advisories referenced by CERT-FR (cert.cyber.gouv.fr).
Linha do tempo
-
CERT-FR: multiple vulnerabilities in Elastic Stack products fixed in 8.19.24, 9.4.9 and 9.5.6
ler a análise desta fonte ocultar
CERT-FR bulletin CERTFR-2026-AVI-1461 covers multiple vulnerabilities in Elastic products. They were fixed in several Elastic security advisories (ESA-2026 series, numbered between 200 and 238) published on 3 November 2026 (discuss.elastic.co thread IDs 391355 to 391375). CERT-FR says they allow remote code execution, remote denial of service, and loss of data confidentiality and integrity. The bulletin lists 16 CVEs. It does not say which CVE maps to which product or impact, and it does not mention exploitation in the wild. The Elastic advisories themselves were not opened in this analysis, so CVSS scores, prerequisites and per-CVE details are unverified.
Technical Details
Affected components are APM Server, Elastic Agent, Elastic Docker Images, Elastic Maps Server, Elasticsearch, Heartbeat, Kibana, Logstash and Packetbeat. The affected versions are 8.x before 8.19.24, 9.x before 9.4.9, and 9.5.x before 9.5.6 (cert.cyber.gouv.fr). The advisories include several for Kibana and several for Elasticsearch. They also include Elastic Agent (including the complete flavor with Synthetics), Heartbeat, Logstash, Packetbeat, APM Server, Docker images and Maps Server (cert.cyber.gouv.fr).
Remediation
Upgrade to 8.19.24, 9.4.9 or 9.5.6, depending on the branch in use. Fixes are listed in the individual Elastic advisories referenced by CERT-FR (cert.cyber.gouv.fr).