Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: Fixes should be...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)

Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: 9.x: All versions from 9.0.0 up to and including 9.4....

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)

Incorrect Authorization in Kibana Leading to Denial of Service Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: A...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)

Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticate...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)

Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side scrip...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-140)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being us...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user...

Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)

Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-163)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a...

Kibana 9.4.4 Security Update (ESA-2026-161)

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...

Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)

Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)

Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An...

APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)

Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map...

Elastic Agent 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-150)

Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where...

Elastic Maps Server 8.19.19, 9.4.4, 9.5.1 Security Update (ESA-2026-148)

Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An...

Kibana 9.4.5 Security Update (ESA-2026-147)

Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing a...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)

Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)

Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-142)

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where tw...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-141)

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' in Elasticsearch Leading to Information Disclosure Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)

Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...

Kibana 9.4.3 Security Update (ESA-2026-61)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow...

Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that...

Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a special...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path...

Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana us...

Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only...

Kibana 9.4.6 Security Update (ESA-2026-84)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder...

Kibana 8.19.17, 9.3.0 Security Update (ESA-2026-31)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. ...

Kibana 9.4.5 Security Update (ESA-2026-97)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting...

Kibana 9.4.5 Security Update (ESA-2026-89)

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead o...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

Kibana 9.4.4 Security Update (ESA-2026-83)

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by t...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-129)

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys Description: Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent...