CVE-2025-37731: Elastic Elasticsearch

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

Affected products

• Elastic Elasticsearch: from 7.0.0, up to and including 7.17.29; from 8.0.0, before 8.19.8 (fixed in 8.19.8); from 9.0.0, before 9.1.8 (fixed in 9.1.8); from 9.2.0, before 9.2.2 (fixed in 9.2.2)

Published 2025-12-15. Last modified 2026-10-07.