Report feedback

Due to improper authorization in Elastic Cloud Enterprise, an authenticated remote attacker with read-only permissions can elevate their privileges. Regardless of the fixes, it is recommended to find and securely remove all user and service accounts created by the user "readonly" [1].

The vulnerability is present in product:

• Elastic Cloud Enterprise; >3.8.0, <=3.8.2; >4.0.0, <=4.0.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-37736 at cve.org, NVD
• CWE-863: Incorrect Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 31. 10. 2025.

Due to improper preservation of permissions in Elastic Defend (Windows), an authenticated local attacker can make a service running as SYSTEM delete arbitrary files on the system, which in some cases may lead to local privilege escalation. Users who cannot update Defend should consider upgrading to Windows 11 24H2 or later, where exploitation is more difficult [2].

The vulnerability is present in product:

• Elastic Defend; <=8.19.5; >=9.0.0, <=9.1.5

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-37735 at cve.org, NVD
• CWE-281: Improper Preservation of Permissions at cwe.mitre.org

The vulnerability was publicly disclosed 6. 11. 2025.

An authenticated remote attacker can carry out an SSRF attack by means of a forged HTTP Origin header processed by the Kibana Observability AI Assistant [3].

The vulnerability is present in product:

• Kibana; >=8.12.0, <=8.19.6; >=9.1.0, <=9.1.6; =9.2.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

• CVE-2025-37734 at cve.org, NVD
• CWE-346: Origin Validation Error at cwe.mitre.org

The vulnerability was publicly disclosed 12. 11. 2025.