CVE-2026-72660

Received Received - Intake

Uncaught Exception in Kibana via Input Data Manipulation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72660

EUVD

EUVD-2026-58271

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	to 8.19.20 (exc)
elastic	kibana	to 9.3.8 (exc)
elastic	kibana	to 9.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

CVE-2026-72660 is an uncaught exception vulnerability in Kibana caused by improper input validation. An authenticated low-privileged user can trigger this by sending specially crafted data, causing an internal error that terminates the Kibana process and leads to a denial of service.

Detection Guidance

Detect this vulnerability by checking Kibana version against affected releases (8.19.19 and earlier, 9.3.7 and earlier, 9.4.4 and earlier). Use commands like 'curl -XGET http://localhost:5601/api/status' to check version or 'dpkg -l | grep kibana' on Debian-based systems.

Impact Analysis

This vulnerability allows an attacker with low privileges to crash Kibana, making it unavailable to all users until the service is manually restarted. It can be repeatedly exploited, causing persistent downtime.

Mitigation Strategies

Upgrade Kibana to patched versions: 8.19.20, 9.3.8, or 9.4.5. If upgrading is not possible, restrict user access to prevent low-privileged users from writing to Elasticsearch indices Kibana reads.

Hi! I’m here to help you understand CVE-2026-72660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70