Vulnerability in Elastic Kibana

[ Description ]Official description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR25 Sep 2026CERTFR-2026-AVI-1228

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-72662CVE-2026-94398CVE-2026-94396+8 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3575

  Kibana: Multiple vulnerabilities Translated from German

  CVE-2026-78582CVE-2026-94400CVE-2026-72662+1 more CVEs

[ References ]References

• discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685Vendor Advisory