Elastic Elasticsearch vulnerabilities
91 published vulnerabilities in Elastic Elasticsearch, 2 of them exploited in the wild. The most were published in 2026 (44), and 44 so far in 2026.
Elastic Elasticsearch vulnerabilities by year
2014
2015
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Elastic Elasticsearch vulnerabilities
- CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution
- CVE-2014-3120 Elasticsearch Remote Code Execution
- CVE-2015-5377 Code injection in n/a
- CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
- CVE-2020-7014 Privilege Escalation Flaw in Elasticsearch
- CVE-2020-7009 Improper Privilege Management in Elasticsearch
- CVE-2018-3831 Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
- CVE-2019-7611 Improper Access Control in Elasticsearch
- CVE-2023-31418 Elasticsearch uncontrolled resource consumption
- CVE-2022-23712 Improper Check for Unusual or Exceptional Conditions in Elasticsearch
- CVE-2021-22146 Information disclosure in n/a
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.