CVE-2026-72644 — MEDIUM (6.5)

Q: How severe is CVE-2026-72644?

CVE-2026-72644 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-72644?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.

Vulnerability Description

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Elastic	Kibana	>= 9.1.7, < 9.4.5

Related Weaknesses (CWE)

CWE-248

References

https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390MitigationVendor Advisory

FAQ

What is CVE-2026-72644?

CVE-2026-72644 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the...

How severe is CVE-2026-72644?

CVE-2026-72644 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-72644?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.