High severity · published Jul 30, 2025
CVE-2025-0712
APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
7.0
CVSS
0.1%
EPSS
No
On KEV
Description
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
APM Server · Elastic
8.16 through 8.16.2; 8.17 through 8.17.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0712
discuss.elastic.co
https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558
More from APM Server
7.5
CVE-2024-23448
APM Server Insertion of Sensitive Information into Log File
7.5
CVE-2023-31421
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
6.5
CVE-2024-37286
APM Server Insertion of Sensitive Information into Log File
5.7
CVE-2024-11994
APM Server Insertion of Sensitive Information into Log File
4.9
CVE-2026-78594
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service