Elastic Cloud Enterprise Flaw Lets Attackers Run Malicious Commands

Elastic Cloud Enterprise (ECE) suffers a template engine injection flaw, tracked as CVE-2025-37729, which could allow attackers with admin privileges to execute arbitrary commands and exfiltrate sensitive data, with CVSS 9.1. The issue affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1, and users are urged to upgrade immediately to ECE 3.8.2 or 4.0.2 as there are no workarounds.

An authenticated ECE admin can craft payloads in submitted deployment plans that are evaluated, enabling code execution, with output readable via ingested logs when Logging+Metrics is enabled. Exploitation requires access to the ECE admin console and to a deployment with Logging+Metrics enabled, meaning a network-reachable attacker with admin rights can pivot without user interaction.

According to Elastic, there are no mitigations or configuration-based workarounds for vulnerable versions, and detection guidance includes monitoring for payload names such as int3rpr3t3r or forPath in request logs. Administrators should prioritise patching, ensure admin access is restricted and audited, and consider temporarily disabling Logging+Metrics on high-risk deployments if upgrades cannot be applied immediately.