MEDIUMCVSS 6.8EPSS 0.2%

CVE-2025-37731

CVE-2025-37731 updated by NVD

Published: 2025-12-15
Modified: 2026-10-09
EPSS percentile: 8%
Sources: github-advisory, nvd

Summary

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.elasticsearch.plugin:x-pack-core	—	8.19.8, 9.1.8, 9.2.2
Maven	org.elasticsearch.plugin:x-pack-security	—	8.19.8, 9.1.8, 9.2.2

Remediation: Upgrade to 8.19.8 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-37731

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.