Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.

Multiple Vulnerabilities in Elastic Beats

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead
    Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially
    crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read
    operations, resulting in application crashes or resource exhaustion. This requires the attacker to be
    positioned on the same network segment as the Packetbeat deployment or to control traffic routed to
    monitored interfaces. (CVE-2026-26933)

The version of Elastic Beats packetbeat installed on the remote host is 8.0.x prior to 8.19.11, 9.0.x prior to 9.2.5. It is, therefore, affected by a denial of service vulnerability. 

  - Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial     of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted,     malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in     application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment     as the Packetbeat deployment or to control traffic routed to monitored interfaces. (CVE-2026-26933)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460111	Echo: github.com/elastic/beats: security update to 7.0.0-alpha2.0.20260126223743-dec1b31111ec	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460111	Echo: github.com/elastic/beats: security update to 7.0.0-alpha2.0.20260126223743-dec1b31111ec	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
303927	Elastic Beats packetbeat 8.0.x < 8.19.11 / 9.0.x < 9.2.5 DoS (ESA-2026-11)	Nessus	Windows	Local	medium
439048	SCA: security update for github.com/elastic/beats/v7 (GHSA-27qj-9gvp-8rh9)	Tenable Cloud Security	SCA Checks	Local	medium
439048	SCA: security update for github.com/elastic/beats/v7 (GHSA-27qj-9gvp-8rh9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-26933

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium