CVE-2018-3825CWE-321

CVE-2018-3825: vulnerability in Elastic Cloud Enterprise (ECE)

Published · Updated

Follow this CVE+ Monitor Elastic Cloud Enterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.
Affected products
Elastic · Elastic Cloud Enterprise (ECE)
Related CVEs — Elastic Cloud Enterprise (ECE)

In the same product, most dangerous first.

CVE-2025-37729CRITICALElastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template EngineEPSS 0.7%CVE-2025-37736HIGHElastic Cloud Enterprise Improper AuthorizationEPSS 0.4%