Kibana Fleet CVE-2026-115294

The attacker must hold an authenticated Kibana account that has been granted Fleet agent-policies write access (a low-privileged but non-default grant), and exploitation only completes when a Kibana administrator independently interacts with the affected Fleet interface - the attacker cannot trigger the deletion alone. Limiting factors: requires both the attacker's authenticated write privilege and separate administrator interaction (UI:R), and affects Kibana versions prior to the fixed 9.4.9 and 9.5.6 releases; environments without low-privileged Fleet-write users are not exposed. Updating to a fixed version is the remediation stated by the vendor.

This is a genuine but not emergency-grade issue. The CVSS 7.3 (High) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H combines network reach and low attack complexity with two meaningful gating factors: PR:L means the attacker must already hold an authenticated Kibana account with Fleet agent-policies write access, and UI:R means a Kibana administrator must subsequently interact with the affected Fleet interface for the deletion to occur. This reads as a privilege-escalation / insider-abuse primitive rather than a mass-exploitable remote flaw. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT on CISA KEV and no proof-of-concept or exploit reference is present (the only reference is the Elastic vendor advisory), so there is no public exploit identified at time of analysis. The vuln.today decision label is this_week, consistent with prompt patching but not act_now/emergency urgency. Net: real priority for environments where low-privileged Fleet users and administrators coexist, but the dual requirement of attacker authentication plus independent admin interaction substantially narrows real-world exploitability.

A low-privileged Kibana user who has been granted Fleet agent-policies write access crafts a path-traversal payload within Fleet so that a later administrative action is redirected onto resources outside the user's authorization. When a Kibana administrator subsequently interacts with the affected Fleet interface, that action deletes unintended resources such as Kibana spaces and other organizational assets the low-privileged user could not have removed directly. No public exploit code is identified at time of analysis.