CVE-2026-72676

Received Received - Intake

Code Injection in Fleet Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72676

EUVD

EUVD-2026-58263

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	fleet_server	*
elastic	kibana	*
elastic	fleet_server	to 8.19.19 (inc)
elastic	fleet_server	to 9.4.4 (inc)
elastic	fleet_server	9.5.0
elastic	fleet_server	8.19.20
elastic	fleet_server	9.4.5
elastic	fleet_server	9.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-72676 is a code injection vulnerability in Fleet Server where improper control of code generation allows attackers to execute malicious scripts. Kibana accepts unsafe identifiers for output configurations, which are later embedded into server-side scripts during agent policy processing. This enables script execution instead of treating the input as data.

Detection Guidance

Detection involves checking Fleet Server and Kibana versions. Commands include: for Fleet Server, check version via 'curl -XGET https://localhost:8220/api/fleet/server' or inspect package manager logs. For Kibana, run 'curl -XGET http://localhost:5601/api/status' to verify version. Compare against patched versions 8.19.20, 9.4.5, or 9.5.1.

Impact Analysis

This vulnerability can lead to high impact on confidentiality and integrity. Attackers could execute arbitrary code on affected systems, potentially gaining unauthorized access, stealing data, or altering system behavior. The attack requires some privileges but can be executed remotely.

Mitigation Strategies

Upgrade Fleet Server and Kibana to versions 8.19.20, 9.4.5, or 9.5.1 immediately. If upgrading is not possible, isolate affected systems and restrict network access to Fleet Server ports. Monitor for unusual script execution or policy changes.

Hi! I’m here to help you understand CVE-2026-72676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70