Elastic Fixes Multiple High-Severity Vulnerabilities in Kibana and Elasticsearch

Elastic has issued five security advisories addressing vulnerabilities in its Kibana and Elasticsearch components, including three critical XSS flaws and two information-disclosure issues. The most severe flaw, CVE-2025-25009, is a stored XSS via Kibana’s case file upload, with affected versions spanning Kibana 7.x (≤7.17.29) and 8.x–9.x up to 9.1.4; patches are available in Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5, while a workaround for 7.12–8.19.0 is recommended where upgrading is not possible.

CVE-2025-25017 (CVSS 8.2) concerns Vega visualisations and can be mitigated by disabling Vega visualisations, via vis_type_vega.enabled: false in kibana.yml, with Elastic Cloud customers able to request deployment-level disablement. A third stored XSS, CVE-2025-25018 (CVSS 8.7), affects Fleet and Integrations management and requires All permissions under Management for Fleet and Integrations; upgrades to 8.18.8, 8.19.5, 9.0.8, or 9.1.5 are advised.

The Elasticsearch audit-logging flaw, CVE-2025-37727 (CVSS 5.3), involves insertion of sensitive information in log files when auditing reindex requests, and users can mitigate by disabling emit_request_body (false) if upgrading is not feasible; upgraded versions remain 8.18.8, 8.19.5, 9.0.8, and 9.1.5. The fifth issue, CVE-2025-37728 (CVSS 5.4), concerns credential leakage in the CrowdStrike connector, with guidance to upgrade to 8.18.8 or higher. according to Elastic.