What’s Vulnerable › Products

Elastic APM Server vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your Elastic APM Server version is affected

Latest Elastic APM Server vulnerabilities

• CVE-2026-78594 — Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service (CVSS 4.9)
• CVE-2025-0712 — APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (CVSS 7.0)
• CVE-2024-11994 — APM Server Insertion of Sensitive Information into Log File (CVSS 5.7)
• CVE-2024-37286 — APM Server Insertion of Sensitive Information into Log File (CVSS 6.5)
• CVE-2024-23448 — APM Server Insertion of Sensitive Information into Log File (CVSS 7.5)
• CVE-2023-31421 — Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue (CVSS 7.5)