CVE-2026-72659 Elastic CVE debrief

Who should care

Elastic Kibana users and administrators, security teams, and IT professionals responsible for monitoring and maintaining Kibana instances should be aware of this vulnerability and take necessary defensive actions to mitigate potential risks.

Technical summary

The CVE-2026-72659 vulnerability in Kibana's visualization feature allows an authenticated user with low-privileged access to cause unbounded memory growth, leading to a denial of service. The issue is caused by a specially crafted, malformed payload that is not correctly validated before use. Processing the request causes memory exhaustion, terminating the Kibana process and making it unavailable to all users until the service is restarted.

Defensive priority

Medium-priority defensive actions are required to address this vulnerability, as it can lead to denial of service via Excessive Allocation.

Recommended defensive actions

• Implement vendor-recommended patches or updates for Kibana to address the vulnerability.
• Conduct thorough inventory checks of Kibana instances to identify potential exposure.
• Review and restrict access controls for low-privileged users to minimize the attack surface.
• Monitor Kibana instances for unusual memory usage patterns or service disruptions.
• Consider implementing compensating controls, such as rate limiting or IP blocking, to mitigate potential attacks.

Evidence notes

The CVE-2026-72659 vulnerability in Kibana's visualization feature allows an authenticated user with low-privileged access to cause unbounded memory growth, leading to a denial of service. The issue is caused by a specially crafted, malformed payload that is not correctly validated before use. To verify affected scope, conduct thorough inventory checks of Kibana instances and review access controls for low-privileged users. Vendor remediation and compensating controls should be implemented to mitigate this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.