6.5

CVE-2026-72644

Uncaught Exception in Kibana Leading to Denial of Service

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Kibana Version >= 9.1.7 < 9.4.5
Elastic ≫ Kibana Version 9.5.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.218
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@elastic.co 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-248 Uncaught Exception

An exception is thrown from a function, but it is not caught.

https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088
Vendor Advisory
Mitigation