What is the CVSS score of CVE-2026-26940?

CVE-2026-26940 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Elastic are affected by CVE-2026-26940?

CVE-2026-26940 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-26940?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Elastic CVE-2026-26940

EUVD-2026-13145 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-03-19 elastic

Denial Of Service Elastic Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 18:00 euvd

EUVD-2026-13145

Analysis Generated

Mar 19, 2026 - 18:00 vuln.today

CVE Published

Mar 19, 2026 - 17:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.

AnalysisAI

A Denial of Service vulnerability exists in Kibana's Timelion visualization plugin that allows authenticated users to trigger excessive memory allocation through improper validation of specially crafted Timelion expressions. An attacker with valid Kibana credentials can overwrite internal series data properties with excessively large quantity values, causing the application to exhaust system resources and become unavailable. This is a network-accessible vulnerability requiring low privileges with a CVSS score of 6.5 and documented as a confirmed denial-of-service attack vector affecting multiple active Kibana versions.

Technical ContextAI

The vulnerability exists in the Timelion visualization component of Elastic Kibana (CPE: cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*), which is a time-series data visualization and analysis tool integrated into the Kibana platform. The root cause is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating that the Timelion expression parser fails to validate or constrain numeric quantity parameters before processing them. When a user submits a specially crafted Timelion expression with an oversized quantity value, the plugin allocates internal memory buffers or data structures based on this unvalidated input without proper bounds checking. The attack mechanism falls under CAPEC-130 (Excessive Allocation), where resource exhaustion occurs through deliberate provision of large quantity values that exceed reasonable operational limits, causing the Kibana process to consume excessive heap memory and potentially trigger out-of-memory conditions that lead to service unavailability.

RemediationAI

Immediately upgrade Elastic Kibana to version 8.19.13 or later (if using the 8.x branch), version 9.2.7 or later (if using the 9.0-9.2 branch), or version 9.3.2 or later (if using the 9.3 branch) as documented in the official Elastic security advisory ESA-2026-20 (https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535). Until patching can be completed, implement the following compensating controls: restrict Kibana access to trusted internal users and networks via firewall rules and reverse proxy authentication; disable or restrict access to the Timelion visualization plugin if not actively used; monitor Kibana process memory and CPU usage for anomalous spikes that may indicate exploitation attempts; and audit Timelion query logs for suspicious expressions containing extremely large numeric values. Consider implementing rate limiting on Timelion expression submissions to further mitigate automated attack attempts.