Elastic 8.19.24, 9.4.9 and 9.5.6 fix 21 flaws, 12 rated high

Elastic 8.19.24, 9.4.9 and 9.5.6 fix 21 flaws, 12 rated high

3 November 2026: Elastic published 21 security advisories on 3 November, all fixed in Elastic Stack 8.19.24, 9.4.9 and 9.5.6, and twelve of them are rated high. Ten of those twelve are not bugs in Elastic's own code but in what it bundles: one Brotli decoder flaw in Node.js that reaches four products, and the compromised eMudhra certificate roots that reach six.

Not yet independently verified. We read the opening summary of each of the 21 advisories and the full text of several; the numbers 202, 207, 213, 214, 217, 219, 220 and 223 to 226 in the range 200 to 238 were not on the forum listing we read. The advisories name no indicators of compromise and say nothing about attacks in the wild. We will update this when it can be confirmed, and remove this note.

Four products, one Brotli bug

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder of Node.js, rated CVSS 8.1. It appears in the advisories for Kibana (ESA-2026-232), Heartbeat (233), Elastic Agent (234) and Elastic Maps Server (238). In each case an attacker needs to control the response to a request the product itself makes, so that a malformed compressed reply reaches the decoder.

For Kibana the outbound paths include Webhook connectors, Workflows HTTP requests and Fleet package registry requests. Elastic confirmed the decoder is reachable but did not reproduce memory corruption or code execution. Where an upgrade must wait, it suggests limiting xpack.actions.allowedHosts, whose default allows every host, keeping xpack.actions.ssl.verificationMode at full, and removing unused connectors. The fixed versions bundle Node.js 24.22.1, the release we covered in our Node.js security item.

Six products, one distrusted authority

The eMudhra advisories (Elasticsearch 227, Logstash 228, Kibana 229, Heartbeat 230, Elastic Agent 231 and the Docker images in 237) all score 7.4. The trust stores in the bundled Java runtime, the bundled Node.js and the operating system bundle in the images include roots that signed eight eMudhra intermediate authorities whose private keys are compromised. Anyone holding those keys could present a certificate for any host name the product trusts, if they sit between it and the remote party. We reported the compromise in an earlier item.

Elasticsearch is exposed wherever it uses the default Java trust store: snapshot repositories, reindex from a remote cluster, Watcher HTTP actions and identity provider metadata. The fixed releases update the bundled Java to 27.0.1.0.3 and remove the eMudhra roots. Self-managed users who cannot upgrade can delete four roots with keytool, namely emSign Root CA G1, G2, emSign ECC Root CA G3 and AAA Certificate Services, but any service chaining only to them will then fail TLS.

The other high-rated fixes

Two high-rated advisories are Elastic's own. ESA-2026-201 (CVSS 7.5) lets an unauthenticated attacker crash an Elasticsearch node through the remote cluster server interface, which is off by default; setting remote_cluster_server.enabled to false or filtering by IP are the stopgaps. ESA-2026-205 (CVSS 7.3) is a path traversal in Kibana Fleet that lets a low-privileged user steer a later administrator action into deleting resources such as spaces; it affects only 9.3.0 to 9.5.5, with no workaround.

Nine medium advisories

The medium group covers cross-space information disclosure in Kibana machine learning and connector logs, Kibana onboarding credentials embedded in host URLs, a field-level security gap for constant_keyword fields, query-cache sharing between restricted and unrestricted users, and denial of service in Packetbeat, APM Server and the phonetic analysis plugin. Elastic Cloud Serverless was patched before disclosure. Our earlier item covers the Elastic Cloud Enterprise batch of 29 October.

Related on TrustList:

• Elastic Cloud Enterprise 3.8.6 and 4.2.1 fix seven security flaws

Sources

• Elastic Security Announcements: ESA-2026-200 to ESA-2026-238 (category listing, 3 November), 3 November 2026
• Elastic: Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-232), 3 November 2026
• Elastic: Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-227), 3 November 2026