BIT-elk-2025-25014

vendorUSosv

Kibana arbitrary code execution via prototype pollution

view advisory published 2025-05-08Licence: per source

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-25014US	critical9.8	22.3% (98th)	Exploit	2025-05-06
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-25014WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan