CVE-2021-37942: Elastic APM Java Agent

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.

Affected products

• Elastic APM Java Agent: from 1.18.0, up to and including 1.27.0

Published 2023-11-22. Last modified 2026-06-17.