ByteOS Network

CVE Vulnerability Details :

CVE-2025-37729

PUBLISHED

More Info Official Page

Assigner-elastic

Assigner Org ID-271b6943-45a9-4f3a-ab4e-976f3fa05b5a

Published At-13 Oct, 2025 | 13:47

Updated At-26 Feb, 2026 | 17:47

▼CVE Numbering Authority (CNA)

Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

Affected Products

Vendor

Elasticsearch BV

Product

Elastic Cloud Enterprise (ECE)

Default Status

unaffected

Versions

Affected

From 2.5.0 through 3.8.1 (semver)
From 4.0.0 through 4.0.1 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-1336	CWE-1336

Type: CWE

CWE ID: CWE-1336

Description: CWE-1336

Metrics

Version	Base score	Base severity	Vector
3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

Hyperlink	Resource
https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641	N/A

Hyperlink: https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References