CVE-2026-115714High· 7.4▾ TwilightImproper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbe…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
docker_images >= 8.0.0 <= 8.19.23docker_images >= 9.0.0 <= 9.4.8docker_images >= 9.5.0 <= 9.5.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-37731Medium· 6.8Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates
CVE-2026-115292Medium· 4.3Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
CVE-2026-115297Medium· 6.5NULL Pointer Dereference in Packetbeat Leading to Denial of Service
CVE-2026-115710Medium· 4.2Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure
CVE-2026-115298Medium· 4.3Incorrect Authorization in Elasticsearch Leading to Information Disclosure
CVE-2026-115289Medium· 4.3Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure