CVE-2025-37729

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)

CWE

CWE-1336

Published

2025-10-13

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• elastic:elastic_cloud_enterprise

References

• https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641

Check your stackJSON