{"affected":[{"defaultStatus":"unaffected","product":"APM Server","source":"CNA: elastic","vendor":"Elastic","versions":[{"lessThanOrEqual":"8.19.23","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.8","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.5.5","status":"affected","version":"9.5.0","versionType":"semver"}]}],"cveId":"CVE-2026-115289","cwes":["CWE-694"],"description":"Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: elastic","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":4.3,"severity":"medium","source":"NVD: security@elastic.co","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793737970687,"publishedAt":1793724238518,"references":[{"source":"CNA: elastic","tags":[],"url":"https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"},{"source":"security@elastic.co","tags":[],"url":"https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"}],"remediation":[],"revision":"c6b9bc9159e9e7f50d21da4b4b9020ed35c3194787c0a3ffb8e203a8eefa8a48","sources":[{"modifiedAt":1793727401024,"name":"CNA: elastic","retrievedAt":1793729327808,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115289"},{"modifiedAt":1793737970687,"name":"NVD","retrievedAt":1793751682655,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115289"}],"ssvc":{"assessedAt":1793727392290,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure","updatedAt":1793751682655}