Detections
Analytics
Kibana 8.x < 8.19.20 / 9.0.x < 9.3.8 / 9.4.x < 9.4.5 Denial of Service (ESA-2026-101)
medium Nessus Plugin ID 338742
Language:
Synopsis
The remote host is affected by a denial of service vulnerability.Description
The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-101 advisory.- Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data.
The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly. (CVE-2026-72660)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update to Kibana version 8.19.20, 9.3.8, 9.4.5 or later.See Also
Plugin Details
Severity: Medium
ID: 338742
File Name: kibana_esa_2026_101.nasl
Version: 1.1
Type: Remote
Family: CGI abuses
Published: 8/21/2026
Updated: 8/21/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.72
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2026-72660
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: cpe:/a:elasticsearch:kibana
Required KB Items: installed_sw/Kibana
Patch Publication Date: 8/13/2026
Vulnerability Publication Date: 8/13/2026
Reference Information
CVE: CVE-2026-72660