CVE-2026-72644CWE-248

CVE-2026-72644

Medium · published September 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-09-02T00:17Z
Affected products (2)
ProductVersionsFixed in
elastic/kibana≥ 9.1.7, < 9.4.59.4.5
elastic/kibanaall versions—
References (1)
https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088 · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:20Z
    Uncaught Exception in Kibana Leading to Denial of Service
    cvelistv5