{"affected":[{"defaultStatus":"unaffected","product":"Elastic Docker images","source":"CNA: elastic","vendor":"Elastic","versions":[{"lessThanOrEqual":"8.19.23","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.8","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.5.5","status":"affected","version":"9.5.0","versionType":"semver"}]}],"cveId":"CVE-2026-115714","cwes":["CWE-295"],"description":"Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: elastic","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793726899774,"publishedAt":1793724258729,"references":[{"source":"CNA: elastic","tags":[],"url":"https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374"}],"remediation":[],"revision":"f6193c8fe6a83c589c05037bbf47ebfab794790d05be0ac9ba40fb8779825ea6","sources":[{"modifiedAt":1793726899774,"name":"CNA: elastic","retrievedAt":1793729338261,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115714"}],"ssvc":{"assessedAt":1793726892980,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections","updatedAt":1793729338261}