CERT-FR flags multiple Elastic Stack vulnerabilities
CERT-FR warns of multiple vulnerabilities across the Elastic product suite enabling RCE, DoS and data confidentiality breaches; patches available.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 16 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-111497 as exploited in the wild.
CERT-FR issued an advisory covering multiple vulnerabilities affecting a wide range of Elastic products, including Elasticsearch, Kibana, Logstash, APM Server, Elastic Agent, Heartbeat, Packetbeat, Elastic Maps Server, and associated Docker images. Affected versions span the 8.x branch prior to 8.19.24 and the 9.x branch prior to 9.4.9 (or 9.5.x prior to 9.5.6). The vulnerabilities, referenced by sixteen distinct CVEs, can allow an attacker to achieve remote arbitrary code execution, remote denial of service, and compromise of data confidentiality and integrity, depending on the specific flaw and affected component.
No evidence of active exploitation in the wild is mentioned in the advisory. CERT-FR directs administrators to Elastic's own security bulletins (ESA-2026 series published 3 November 2026) for full technical details and patches. Given the broad scope of affected components across the Elastic observability and search stack, organizations running any of the listed products should prioritize patching to the fixed versions, particularly for internet-facing or multi-tenant Elasticsearch/Kibana deployments where RCE or confidentiality impacts could be most consequential.
Defenders should inventory all Elastic Stack deployments (self-hosted and containerized via Docker images) to confirm version levels, apply the referenced updates, and review Elastic's bulletins for component-specific detail on which CVEs affect which products, since the advisory covers a large number of separate fixes bundled into one release cycle.
Mentioned in this report
Detection guidance
Elastic Stack Process Spawning Shell or Script Interpreter on Windows
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Elasticsearch (java), Logstash or Kibana (node) spawning cmd, PowerShell or script hosts, which is a typical post-exploitation sign of RCE in Elastic components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Elastic Stack Process Spawning Shell or Script Interpreter on Windows
id: 97b1d98f-ef15-5e87-85c8-16bbe9fd48ef
status: experimental
description: Detects Elasticsearch, Logstash or Kibana runtime processes (java.exe
or node.exe) spawning command shells, PowerShell or script hosts. The Elastic advisory
describes remote code execution flaws across the stack, and a shell child of these
services is a generic post-exploitation indicator. Does not depend on a specific
CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent_java:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- org.elasticsearch
- logstash
selection_parent_node:
ParentImage|endswith: \node.exe
ParentCommandLine|contains: kibana
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: 1 of selection_parent_* and selection_child
falsepositives:
- Logstash pipelines using the exec output or input plugin to invoke cmd or PowerShell
scripts
- Administrators running maintenance scripts through Elasticsearch or Logstash service
wrappers
level: medium
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461
Elastic Stack Process Spawning Shell on Linux
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Elasticsearch, Logstash or Kibana runtime spawning a shell or download or reverse-shell utility on Linux, which is consistent with exploitation of RCE flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Elastic Stack Process Spawning Shell on Linux
id: abbeed99-6ea6-51ac-9f35-b7eced240df2
status: experimental
description: Detects Elasticsearch or Logstash (java) and Kibana (node) spawning an
interactive shell or common download and reverse-shell utilities on Linux. Elastic
advisories cover remote code execution across the stack, and these services rarely
launch shells in normal operation.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent_java:
ParentImage|endswith: /java
ParentCommandLine|contains:
- org.elasticsearch
- logstash
selection_parent_node:
ParentImage|endswith: /node
ParentCommandLine|contains: kibana
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /nc
- /ncat
- /curl
- /wget
condition: 1 of selection_parent_* and selection_child
falsepositives:
- Logstash pipelines using the exec plugin to run shell scripts
- Elasticsearch startup or plugin scripts invoking sh during maintenance
level: medium
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs