Elastic APM Server
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-78594 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service | MEDIUM 4.9 | 0.5 % | ||
| CVE-2025-0712 | 8.16 – 8.16.2 ; 8.17 – 8.17.0 | APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer | HIGH 7.0 | 0.2 % | ||
| CVE-2024-11994 | 8.0.0 – < 8.16.1 | APM Server Insertion of Sensitive Information into Log File | MEDIUM 5.7 | 0.3 % | ||
| CVE-2024-37286 | fixed in 8.14.0 | APM Server Insertion of Sensitive Information into Log File | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-23448 | 8.12 – < 8.12.1 | APM Server Insertion of Sensitive Information into Log File | HIGH 7.5 | 0.7 % | ||
| CVE-2023-31421 | 8.0.0, 8.9.2 | Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue | HIGH 7.5 | 0.3 % |