Elastic Kibana CVE-2026-33462

Exploitation requires an authenticated Kibana account with at least limited permissions to create a dashboard object (per PR:L), and critically depends on an administrator subsequently performing a delete action on that attacker-crafted dashboard through the Kibana UI (per UI:R) - the vulnerability cannot trigger on its own. The specific prerequisite is access to Kibana's dashboard management functionality to supply a maliciously crafted dashboard identifier containing path-traversal sequences. Limiting factors that reduce real-world risk: the required privileged human action makes it non-automatable (SSVC Automatable:no), the attacker needs valid credentials, and impact is confined to integrity/availability (resource/account deletion) with no data disclosure (C:N). Affected deployments are Kibana 9.0.0-9.3.4 and 8.0.0-8.19.15; versions 8.19.16 and 9.3.5 contain the fix.

This is a moderate-severity, low-urgency issue despite its 7.3 CVSS. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) describes a network-reachable but authenticated (PR:L) and user-interaction-dependent (UI:R) flaw with no confidentiality impact (C:N) and high integrity/availability impact limited to resource deletion. Every real-world signal points away from active mass exploitation: EPSS is 0.03% (8th percentile), there is no CISA KEV listing, no public exploit identified, and the CISA SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The attack is inherently non-automatable because it hinges on a specific privileged human action - an administrator manually deleting an attacker-planted dashboard - which is why SSVC and EPSS both score it low even though the integrity/availability consequences (account/resource deletion) are serious. Signals are internally consistent here; the main nuance is that CVSS treats this as high I/A impact while the practical probability of the triggering condition is low. Priority should be routine patching rather than emergency response, with attention weighted by how exposed the Kibana instance is to lower-privileged internal users.

A low-privileged but authenticated Kibana user creates a dashboard whose identifier is crafted with path-traversal sequences. When an administrator later uses the Kibana UI to delete that malicious dashboard, the deletion request is redirected to an unintended internal endpoint, causing deletion of user accounts or other backend resources. No public exploit code is identified at time of analysis, and the attack cannot succeed without the administrator performing the delete action.