PT-2025-18388 · Elastic · Endpoint Security+1

Published 2025-05-01 · Updated 2025-05-02 · CVE-2023-46669

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Elastic Agent and Elastic Security Endpoint (affected versions not specified)

Description Exposure of sensitive information to local unauthorized actors can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and there is no indication that it is known or has been exploited by malicious actors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-10466

CVE-2023-46669

Affected Products

Agent

Endpoint Security

References · 6

• https://discuss.elastic.co/t/elastic-agent-elastic-endpoint-security-security-update-esa-2025-03/377706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46669 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46669 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10466 · Security Note
• https://t.me/cvenotify/120470 · Telegram Post
• https://twitter.com/CVEnew/status/1918181394137903501 · Twitter Post