CVE-2026-72676

Katalog CVE

CVSS 9.1 · Critical EPSS 0,55%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada elastic kibana. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510 advisory vendor