This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elastic fixes 4 vulnerabilities
Elastic fixes 4 vulnerabilities in various products. Products and their fixed versions: Metricbeat - 8.19.13, 9.2.5 [1] Kibana - 8.19.13, 9.2.7, 9.3.2 [2][3] Packetbeat - 8.19.4, 9.2.4 [4]
An authenticated adjacent attacker can carry out a DoS attack on Elastic Metricbeat by causing allocation of an excessive amount of memory [1].
The vulnerability is present in product:
- Elastic Metricbeat; >=8.0.0, <8.19.13; >=9.0.0, <9.2.5;
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-26931 at cve.org, NVD
- CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2026.
An authenticated remote attacker with rule management privileges can make unauthorized configuration of response actions on client devices in Elastic Kibana [2].
The vulnerability is present in product:
- Elastic Kibana; >=8.0.0, <8.19.12; >=9.0.0, <9.2.6; >=9.3.0, <9.3.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2026-26939 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2026.
An authenticated remote attacker can carry out a DoS attack on Elastic Kibana by causing allocation of an excessive amount of memory after sending a specially crafted Timelion expression [3].
The vulnerability is present in product:
- Elastic Kibana; >=8.0.0, <8.19.13; >=9.0.0, <9.2.7; >=9.3.0, <9.3.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-26940 at cve.org, NVD
- CWE-1284: Improper Validation of Specified Quantity in Input at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2026.
An authenticated adjacent attacker can carry out a DoS attack on Elastic Packetbeat by causing an out-of-bounds memory access or exhausting available free memory by sending specially crafted packets [4].
The vulnerability is present in product:
- Elastic Packetbeat; >=8.0.0, <8.19.11; >=9.0.0, <9.2.5;
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-26933 at cve.org, NVD
- CWE-129: Improper Validation of Array Index at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2026.
Links
- [1] https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532
- [2] https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530
- [3] https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535
- [4] https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533
By CESNET, z.s.p.o. Martin Krajči on 20. 3. 2026.