Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)

Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a...

Kibana 9.4.3 Security Update (ESA-2026-61)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow...

Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the...

Kibana 8.19.17, 9.3.0 Security Update (ESA-2026-31)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)

Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can...