Elastic Beats 7.x / 8.x < 8.19.10 / 9.x < 9.1.10 / 9.2.x < 9.2.4 Multiple Vulnerabilities (ESA_2026_01, ESA_2026_02)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(286270);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2026-0528", "CVE-2026-0529");
  script_xref(name:"IAVA", value:"2026-A-0054-S");

  script_name(english:"Elastic Beats 7.x / 8.x < 8.19.10 / 9.x < 9.1.10 / 9.2.x < 9.2.4 Multiple Vulnerabilities (ESA_2026_01, ESA_2026_02)");

  script_set_attribute(attribute:"synopsis", value:
"The Elastic Beats installation on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Elastic Beats (Metricbeat or Packetbeat) installed on the remote host is 7.x, 8.x prior to 8.19.10, 
9.x prior to 9.1.10, or 9.2.x prior to 9.2.4. It is, therefore, affected by multiple vulnerabilities:

    - Improper Validation of Array Index (CWE-129) and Improper Input Validation (CWE-20) in Metricbeat 
      can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153). 
      This is exploitable via specially crafted, malformed payloads sent to the Graphite or Zookeeper 
      server metricsets, or via malformed metric data processed by the Prometheus helper module. 
      (CVE-2026-0528)

    - Improper Validation of Array Index (CWE-129) in Packetbeat's MongoDB protocol parser can allow an 
      attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This 
      requires an attacker to send a malformed payload to a monitored network interface where MongoDB 
      protocol parsing is enabled, potentially leading to an application crash. (CVE-2026-0529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/packetbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-02/384520
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1fa1dede");
  # https://discuss.elastic.co/t/metricbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-01/384519
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c3e5a80b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elastic Beats filebeat version 8.19.10, 9.1.10, 9.2.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-0528");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:elastic:beats_filebeat");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elastic_beats_filebeat_win_installed.nbin");
  script_require_keys("installed_sw/Beats filebeat", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Beats filebeat', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '7.0.0',  'max_version' : '8.19.9',  'fixed_version' : '8.19.10' },
        { 'min_version' : '9.0.0',  'max_version' : '9.1.9',   'fixed_version' : '9.1.10' },
        { 'min_version' : '9.2.0',  'max_version' : '9.2.3',   'fixed_version' : '9.2.4' }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);