Elastic Fleet Server
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-78587 | 8.0.0 – 8.19.15 ; 9.0.0 – 9.3.4 ; 9.4.0 – 9.4.1 | Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations | LOW 3.1 | 0.3 % | ||
| CVE-2026-72657 | 8.3.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72676 | 8.5.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Improper Control of Generation of Code in Fleet Server Leading to Code Injection | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-56150 | 9.0.0 – 9.2.4 ; 8.0.0 – 8.19.10 | Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service | HIGH 7.5 | 0.5 % | ||
| CVE-2024-52975 | 8.13.0 – < 8.15.0 | Fleet Server sensitive information exposure via logs | CRITICAL 9.0 | 0.3 % | ||
| CVE-2023-31421 | 8.0.0, 8.9.2 | Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue | HIGH 7.5 | 0.3 % | ||
| CVE-2023-46667 | 8.10.0 – < 8.10.3 | Fleet Server Insertion of Sensitive Information into Log File | HIGH 8.1 | 0.7 % |