What is CVE-2025-37735?

CVE-2025-37735 is a high-severity vulnerability in Elastic Kibana, classified under Improper Preservation of Permissions. CVSS score: 7.0/10. Published 2025-11-06.

How severe is CVE-2025-37735?

High severity. CVSS v3 base score is 7.0 out of 10.

Vulnerability in Elastic Kibana

CVE-2025-37735

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.

EPSS: 0.001 (3.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Elastic Kibana — versions 8.0.0, 9.0.0

Weakness classification (CWE)

CWE-281 — Improper Preservation of Permissions

References

security@elastic.co

Frequently asked questions

What is CVE-2025-37735?: CVE-2025-37735 is a high-severity vulnerability in Elastic Kibana, classified under Improper Preservation of Permissions. CVSS score: 7.0/10. Published 2025-11-06.
How severe is CVE-2025-37735?: High severity. CVSS v3 base score is 7.0 out of 10.