Elastic vulnerabilities (CVEs)

68 CVEs matched to Elastic by name in NVD, none on CISA's Known Exploited list.

Back to the Elastic profile · Alternatives to Elastic · CVE RSS feed

Exploitation riskProbably exploited

68 of 68 CVEs assessed

confirmed exploited

EPSS ≥ 10%

>99%

highest single CVE

39 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 5 EPSS observations per CVE.

CVE-2019-1867 ↗EPSS 30%LEV ≥>99%Probably exploited
A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST …
CVE-2017-6683 ↗EPSS 5.9%LEV ≥>99%Probably exploited
A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands …
CVE-2016-0635 ↗EPSS 5.1%LEV ≥>99%Probably exploited
Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health…

Recent changes

last 90 days

CVE-2017-6693 is now estimated at a 27% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2016-0732 is now estimated at a 72% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2017-2773 is now estimated at a 91% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2017-6689 is now estimated at a 82% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2017-6776 is now estimated at a 62% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Total
2019	1	4	1	0	6
2018	2	1	4	1	8
2017	8	15	16	0	39
2016	1	7	2	0	10
2012	0	0	1	1	2
2009	0	1	1	0	2
2008	0	0	1	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2019-1867	30%	98%
CVE-2017-6683	5.9%	93%
CVE-2016-0635	5.1%	92%
CVE-2017-6713	2.9%	87%
CVE-2017-10335	2.6%	85%
CVE-2018-0121	2.5%	85%
CVE-2017-6684	2.3%	83%
CVE-2017-6688	2.3%	83%
CVE-2017-6682	2.2%	82%
CVE-2008-1606	2.1%	82%

Known CVEs (68)

RSS ⇢

CVE-2019-7618 ↗MEDIUM 6.52019
A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local file…
CVE-2019-7617 ↗HIGH 7.22019
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attac…
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Elastic by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-08-13.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.