← Back

CVE-2026-72644

nvd nist
Published: Sep 1, 2026Modified: Sep 2, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security@elastic.co (Secondary)

Description

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

Affected (2)

Products: Elastic: Kibana
Elastic
1 product
Kibana
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Elastic
Kibana
From 9.1.7 to 9.4.5
Kibana
Version 9.5.0

Related CWEs

CWE-248
Uncaught Exception
An exception is thrown from a function, but it is not caught.

References (1)

Source: security@elastic.co
MitigationVendor Advisory

Timeline

No history available yet.