Assessment
Why it matters
EPSS is 0.3%; technical severity is CVSS 7.7.
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).
Who should care
- Teams operating Kibana
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Kibana is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Vendor advisory from discuss.elastic.co
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- CWE
- CWE-250
- Affected versions
- Elastic Kibana (Start Including 8.0.0, End Excluding 8.19.14 | Start Including 9.0.0, End Excluding 9.2.8 | Start Including 9.3.0, End Excluding 9.3.3)
- Fixed versions
- Elastic Kibana (Fixed from 8.19.14, 9.2.8, 9.3.3)
- Published
- 8 April 2026
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
Signal timeline
- CVE published
- Latest EPSS score: 0.3%
- Signal calculated at 12