VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-26939

CVE-2026-26939

Description

Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Elastic/Kibana4 versions
    cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.12
    • cpe:2.3:a:elastic:kibana:9.3.0:*:*:*:*:*:*:*
    • (no CPE)range: <8.19.12, <9.2.6, <9.3.1
    • (no CPE)range: 9.0.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.