CVE-2026-72676 Elastic CVE debrief

Who should care

Elastic Kibana users with Fleet Server configurations, security teams monitoring for code injection attacks, and administrators responsible for applying security updates. Additionally, operators managing Kibana deployments, platform administrators, and security teams responsible for vulnerability management should be aware of this issue and take necessary actions.

Technical summary

CVE-2026-72676 involves improper control of code generation in Fleet Server, allowing code injection attacks. Kibana accepted identifiers without restricting safe characters, which were then executed as part of server-side scripts during agent policy processing. This vulnerability can lead to the execution of attacker-supplied script content via Code Injection. Elastic has provided security updates for affected Kibana versions.

Defensive priority

Medium-priority defensive review recommended due to potential code injection risk.

Recommended defensive actions

• Review and apply vendor security updates for Kibana versions 8.5.0 to 8.19.20 and 9.0.0 to 9.4.5.
• Conduct inventory checks for affected Kibana versions and configurations.
• Implement compensating controls to monitor and restrict Fleet Server script execution.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from official CVE and NVD sources indicates Kibana vulnerability via code injection; vendor advisory available. Further verification of affected versions and configurations recommended. Elastic has provided security updates for Kibana versions 8.5.0 to 8.19.20 and 9.0.0 to 9.4.5. Users should review and apply these updates according to their change control processes. Compensating controls, such as monitoring and restricting Fleet Server script execution, can be implemented while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.