Vulnerability in Elastic Kibana

[ Description ]Official description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR25 Sep 2026CERTFR-2026-AVI-1228

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-72662CVE-2026-94398CVE-2026-94396+8 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3575

  Kibana: Multiple vulnerabilities Translated from German

  CVE-2026-78582CVE-2026-94400CVE-2026-72662+1 more CVEs

[ References ]References

• discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680