What is the CVSS score of CVE-2026-26939?

CVE-2026-26939 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Elastic are affected by CVE-2026-26939?

CVE-2026-26939 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-26939?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Elastic CVE-2026-26939

EUVD-2026-13143 MEDIUM

Missing Authorization (CWE-862)

2026-03-19 elastic

Elastic Authentication Bypass Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 18:00 euvd

EUVD-2026-13143

Analysis Generated

Mar 19, 2026 - 18:00 vuln.today

CVE Published

Mar 19, 2026 - 17:11 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

AnalysisAI

Kibana's Detection Rule Management lacks proper authorization controls, allowing authenticated users with rule management privileges to configure unauthorized endpoint response actions including host isolation and process termination. An attacker with these privileges could exploit this missing access control to execute sensitive endpoint operations beyond their intended scope. No patch is currently available for this medium-severity vulnerability affecting Elastic products.

Technical ContextAI

The vulnerability exists in Kibana's server-side Detection Rule Management API, which is responsible for managing detection rules and their associated response actions in Elastic's security platform. The root cause is classified as CWE-862 (Missing Authorization), where endpoint response action configuration endpoints fail to properly enforce access control lists (ACLs) as described in CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). Kibana (cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is the web interface and analytics platform for Elasticsearch that manages security detection rules and automated response capabilities. The authorization bypass allows authenticated users with legitimate rule management privileges to escalate their actions beyond their intended scope, specifically to configure response actions that should be restricted to higher-privileged roles.

RemediationAI

Immediately upgrade Kibana to version 8.19.12 or later for the 8.x branch, version 9.2.6 or later for the 9.0-9.2 branch, or version 9.3.1 or later for the 9.3 branch (see Elastic security advisory at https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530). As a temporary mitigation prior to patching, restrict Kibana rule management API access to trusted networks via network segmentation or reverse proxy rules, audit and minimize the number of users granted rule management privileges, and implement role-based access controls to ensure only senior security analysts or administrators can configure endpoint response actions. Monitor Kibana audit logs for unusual detection rule modifications or response action configurations by lower-privileged accounts.