{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Heartbeat versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Heartbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "APM Server versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "APM Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Heartbeat versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Heartbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Packetbeat versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Packetbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Logstash versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Logstash",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Maps Server versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Elastic Maps Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Maps Server versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Elastic Maps Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Logstash versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Logstash",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Maps Server versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Elastic Maps Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Heartbeat versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Heartbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Packetbeat versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Packetbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "APM Server versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "APM Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Logstash versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Logstash",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Docker Images versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Elastic Docker Images",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Packetbeat versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Packetbeat",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "APM Server versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "APM Server",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Docker Images versions 8.x ant\u00e9rieures \u00e0 8.19.24",
      "product": {
        "name": "Elastic Docker Images",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.x ant\u00e9rieures \u00e0 9.4.9",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Docker Images versions 9.5.x ant\u00e9rieures \u00e0 9.5.6",
      "product": {
        "name": "Elastic Docker Images",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-115292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115292"
    },
    {
      "name": "CVE-2026-91403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91403"
    },
    {
      "name": "CVE-2026-115710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115710"
    },
    {
      "name": "CVE-2026-115289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115289"
    },
    {
      "name": "CVE-2026-115298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115298"
    },
    {
      "name": "CVE-2026-115715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115715"
    },
    {
      "name": "CVE-2026-115294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115294"
    },
    {
      "name": "CVE-2026-114406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
    },
    {
      "name": "CVE-2026-115293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115293"
    },
    {
      "name": "CVE-2026-115714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115714"
    },
    {
      "name": "CVE-2026-115290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115290"
    },
    {
      "name": "CVE-2026-115716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115716"
    },
    {
      "name": "CVE-2026-114820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114820"
    },
    {
      "name": "CVE-2026-115295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115295"
    },
    {
      "name": "CVE-2026-115297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115297"
    },
    {
      "name": "CVE-2026-111497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
    }
  ],
  "initial_release_date": "2026-11-04T00:00:00",
  "last_revision_date": "2026-11-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1461",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Elastic. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Elastic",
  "vendor_advisories": [
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391359",
      "url": "https://discuss.elastic.co/t/kibana-9-4-9-9-5-6-security-update-esa-2026-205/391359"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391363",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-210/391363"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391373",
      "url": "https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391358",
      "url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391371",
      "url": "https://discuss.elastic.co/t/elastic-agent-8-19-24-9-4-9-9-5-6-security-update-esa-2026-234/391371"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391360",
      "url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391361",
      "url": "https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391357",
      "url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-203/391357"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391369",
      "url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-232/391369"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391374",
      "url": "https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391355",
      "url": "https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391372",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391356",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391368",
      "url": "https://discuss.elastic.co/t/elastic-agent-complete-flavor-synthetics-8-19-24-9-4-9-9-5-6-security-update-esa-2026-231/391368"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391362",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391366",
      "url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-229/391366"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391370",
      "url": "https://discuss.elastic.co/t/heartbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-233/391370"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391364",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-227/391364"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391367",
      "url": "https://discuss.elastic.co/t/heartbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-230/391367"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391365",
      "url": "https://discuss.elastic.co/t/logstash-8-19-24-9-4-9-9-5-6-security-update-esa-2026-228/391365"
    },
    {
      "published_at": "2026-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 391375",
      "url": "https://discuss.elastic.co/t/elastic-maps-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-238/391375"
    }
  ]
}