# CERT-FR flags multiple Elastic Stack vulnerabilities

Published: 2026-11-04 · Severity: severe · Sectors: Technology
Canonical: https://vorant.io/reports/32c8b7f0-3f6d-533b-aec0-bf5a15edf45c/cert-fr-flags-multiple-elastic-stack-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of multiple vulnerabilities across the Elastic product suite enabling RCE, DoS and data confidentiality breaches; patches available.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461

## What to check

- Applies to: The 16 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 as exploited in the wild.

CERT-FR issued an advisory covering multiple vulnerabilities affecting a wide range of Elastic products, including Elasticsearch, Kibana, Logstash, APM Server, Elastic Agent, Heartbeat, Packetbeat, Elastic Maps Server, and associated Docker images. Affected versions span the 8.x branch prior to 8.19.24 and the 9.x branch prior to 9.4.9 (or 9.5.x prior to 9.5.6). The vulnerabilities, referenced by sixteen distinct CVEs, can allow an attacker to achieve remote arbitrary code execution, remote denial of service, and compromise of data confidentiality and integrity, depending on the specific flaw and affected component.

No evidence of active exploitation in the wild is mentioned in the advisory. CERT-FR directs administrators to Elastic's own security bulletins (ESA-2026 series published 3 November 2026) for full technical details and patches. Given the broad scope of affected components across the Elastic observability and search stack, organizations running any of the listed products should prioritize patching to the fixed versions, particularly for internet-facing or multi-tenant Elasticsearch/Kibana deployments where RCE or confidentiality impacts could be most consequential.

Defenders should inventory all Elastic Stack deployments (self-hosted and containerized via Docker images) to confirm version levels, apply the referenced updates, and review Elastic's bulletins for component-specific detail on which CVEs affect which products, since the advisory covers a large number of separate fixes bundled into one release cycle.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (KEV), CVE-2026-114406, CVE-2026-114820, CVE-2026-115289, CVE-2026-115290, CVE-2026-115292, CVE-2026-115293, CVE-2026-115294, CVE-2026-115295, CVE-2026-115297, CVE-2026-115298, CVE-2026-115710, CVE-2026-115714, CVE-2026-115715, CVE-2026-115716, CVE-2026-91403

## Detection guidance (public sample)

### Elastic Stack Process Spawning Shell or Script Interpreter on Windows

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Elasticsearch (java), Logstash or Kibana (node) spawning cmd, PowerShell or script hosts, which is a typical post-exploitation sign of RCE in Elastic components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Elastic Stack Process Spawning Shell or Script Interpreter on Windows
id: 97b1d98f-ef15-5e87-85c8-16bbe9fd48ef
status: experimental
description: Detects Elasticsearch, Logstash or Kibana runtime processes (java.exe
  or node.exe) spawning command shells, PowerShell or script hosts. The Elastic advisory
  describes remote code execution flaws across the stack, and a shell child of these
  services is a generic post-exploitation indicator. Does not depend on a specific
  CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_java:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - org.elasticsearch
    - logstash
  selection_parent_node:
    ParentImage|endswith: \node.exe
    ParentCommandLine|contains: kibana
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: 1 of selection_parent_* and selection_child
falsepositives:
- Logstash pipelines using the exec output or input plugin to invoke cmd or PowerShell
  scripts
- Administrators running maintenance scripts through Elasticsearch or Logstash service
  wrappers
level: medium
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461
```

### Elastic Stack Process Spawning Shell on Linux

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Elasticsearch, Logstash or Kibana runtime spawning a shell or download or reverse-shell utility on Linux, which is consistent with exploitation of RCE flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Elastic Stack Process Spawning Shell on Linux
id: abbeed99-6ea6-51ac-9f35-b7eced240df2
status: experimental
description: Detects Elasticsearch or Logstash (java) and Kibana (node) spawning an
  interactive shell or common download and reverse-shell utilities on Linux. Elastic
  advisories cover remote code execution across the stack, and these services rarely
  launch shells in normal operation.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent_java:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - org.elasticsearch
    - logstash
  selection_parent_node:
    ParentImage|endswith: /node
    ParentCommandLine|contains: kibana
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /nc
    - /ncat
    - /curl
    - /wget
  condition: 1 of selection_parent_* and selection_child
falsepositives:
- Logstash pipelines using the exec plugin to run shell scripts
- Elasticsearch startup or plugin scripts invoking sh during maintenance
level: medium
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1461

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/32c8b7f0-3f6d-533b-aec0-bf5a15edf45c/cert-fr-flags-multiple-elastic-stack-vulnerabilities.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup