Detections
Analytics
Kibana 8.x < 8.19.20 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Denial of Service (ESA-2026-136)
low Nessus Plugin ID 338733
Language:
Synopsis
The remote host is affected by a denial of service vulnerability.Description
The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-136 advisory.- Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
(CVE-2026-49096)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update to Kibana version 8.19.20, 9.3.5, 9.4.2 or later.See Also
Plugin Details
Severity: Low
ID: 338733
File Name: kibana_esa_2026_136.nasl
Version: 1.3
Type: Remote
Family: CGI abuses
Published: 8/21/2026
Updated: 9/3/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS Score Source: CVE-2026-49096
CVSS v3
Risk Factor: Low
Base Score: 3.5
Temporal Score: 3.1
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:elasticsearch:kibana
Required KB Items: installed_sw/Kibana
Exploit Ease: No known exploits are available
Patch Publication Date: 8/13/2026
Vulnerability Publication Date: 8/13/2026
Reference Information
CVE: CVE-2026-49096
CWE: 248
IAVB: 2026-B-0232