Security vendor · SIEM · in CISA KEV
Elastic in the CISA KEV catalog
CISA’s Known Exploited Vulnerabilities catalog lists 3 entries for Elastic as of catalog version 2026.11.06, released November 6, 2026. The newest was added March 25, 2022, and the latest federal due date is July 10, 2022.
Updated
- entries in the catalog
- 3
- newest addition
- March 25, 2022
- latest federal due date
- July 10, 2022
- marked known ransomware use
- 0
Directory record
- Website
- www.elastic.co
- Categories
- SIEM (primary), EDR and XDR, SOAR and security automation
- Headquarters
- HQ not established
- Founded
- Not established
- Ownership
- Ownership not established
- Company record
- Elastic on CISO Tribune
Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.
KEV entries, newest first
Filed by CISA under the name “Elastic”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.
Added March 25, 2022
CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
Elasticsearch
Due April 15, 2022
Added March 25, 2022
CVE-2014-3120 Elasticsearch Remote Code Execution Vulnerability
Elasticsearch
Due April 15, 2022
Added January 10, 2022
CVE-2019-7609 Kibana Arbitrary Code Execution
Kibana
Due July 10, 2022
Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.
On Daily CISO, newest first
No briefing or archive item names Elastic yet. Every item about a security vendor is on the vendor news page.
Sources
- Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
- Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
- CISO Tribune, vendor directory record for Elastic, published November 8, 2026