Elastic Fleet Server vulnerabilities

5 CVEs affecting Elastic Fleet Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78587, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-46667, published 2023-10-26. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow…
CVE-2026-56150, published 2026-07-01. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request…
CVE-2026-72657, published 2026-08-13. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for…
CVE-2026-78587, published 2026-09-02. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership…
CVE-2024-52975, published 2025-01-23. Critical severity, CVSS 9.0. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends…