{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Elastic vulnerabilities","home_page_url":"https://patchfirst.co/vendor/elastic/","feed_url":"https://patchfirst.co/feed/vendor/elastic.json","description":"New and newly exploited Elastic CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-31419","url":"https://patchfirst.co/cve/CVE-2023-31419/","title":"CVE-2023-31419: Elasticsearch StackOverflow vulnerability","content_text":"Elastic · Elasticsearch. Not in CISA KEV. EPSS 61.1% (higher than 99.16% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. Priority 29.4 of 100.","summary":"Elasticsearch StackOverflow vulnerability","date_published":"2023-10-26T00:00:00.000Z","date_modified":"2025-02-13T16:50:07.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":29.4,"kev":null,"epss":{"score":0.61069,"percentile":0.99157},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Elastic","product":"Elasticsearch","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-23714","url":"https://patchfirst.co/cve/CVE-2022-23714/","title":"CVE-2022-23714: A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint…","content_text":"Elastic · Endpoint Security. Not in CISA KEV. EPSS 0.2% (higher than 14.1% of CVEs). Priority 47.8 of 100.","summary":"A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint…","date_published":"2022-07-06T00:00:00.000Z","date_modified":"2024-08-03T03:51:45.000Z","tags":[],"_patchfirst":{"reason":"published","priority":47.8,"kev":null,"epss":{"score":0.00231,"percentile":0.14056},"cvss":null,"vendor":"Elastic","product":"Endpoint Security","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2015-1427#kev","url":"https://patchfirst.co/cve/CVE-2015-1427/","title":"[KEV] CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","content_text":"Elastic · Elasticsearch. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:22:24.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.99906,"percentile":0.99966},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Elastic","product":"Elasticsearch","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-3120#kev","url":"https://patchfirst.co/cve/CVE-2014-3120/","title":"[KEV] CVE-2014-3120: Elasticsearch Remote Code Execution Vulnerability","content_text":"Elastic · Elasticsearch. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 88.6% (higher than 99.77% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.","summary":"Elasticsearch Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T00:07:37.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.88559,"percentile":0.99772},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Elastic","product":"Elasticsearch","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-7609#kev","url":"https://patchfirst.co/cve/CVE-2019-7609/","title":"[KEV] CVE-2019-7609: Kibana Arbitrary Code Execution","content_text":"Elastic · Kibana. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.8 of 100.","summary":"Kibana Arbitrary Code Execution","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-06-17T02:40:45.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.8,"kev":{"dateAdded":"2022-01-10","ransomware":false},"epss":{"score":0.95338,"percentile":0.99866},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Elastic","product":"Kibana","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22145","url":"https://patchfirst.co/cve/CVE-2021-22145/","title":"CVE-2021-22145: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting","content_text":"Elastic · Elasticsearch. Not in CISA KEV. EPSS 76.2% (higher than 99.54% of CVEs). Public exploit code exists. Priority 25.6 of 100.","summary":"A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting","date_published":"2021-07-21T00:00:00.000Z","date_modified":"2025-07-08T10:53:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":25.6,"kev":null,"epss":{"score":0.76249,"percentile":0.99536},"cvss":null,"vendor":"Elastic","product":"Elasticsearch","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-17246","url":"https://patchfirst.co/cve/CVE-2018-17246/","title":"CVE-2018-17246: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin","content_text":"Elastic · Kibana. Not in CISA KEV. EPSS 84.3% (higher than 99.7% of CVEs). Public exploit code exists. Priority 61.3 of 100.","summary":"Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin","date_published":"2018-12-20T00:00:00.000Z","date_modified":"2024-08-05T10:47:04.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":61.3,"kev":null,"epss":{"score":0.84294,"percentile":0.99697},"cvss":null,"vendor":"Elastic","product":"Kibana","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}