Elastic Kibana CVE-2026-33465

Exploitation requires a valid Kibana account with at minimum low-level permissions - confirmed by CVSS PR:L. No special non-default configuration is described as necessary; any functional Kibana deployment reachable over the network is potentially vulnerable once an attacker holds credentials. What limits exploitation: the attacker must possess or obtain a legitimate Kibana credential (PR:L prevents unauthenticated mass exploitation); deployments behind VPN or strict network segmentation further reduce exposure. The impact is confined to availability only (C:N/I:N) - no data disclosure or modification is possible through this vector.

The CVSS 6.5 Medium score accurately reflects the constrained impact profile: high availability disruption (A:H) offset by the PR:L authentication requirement. Real-world risk is moderate-to-meaningful for organizations with broad Kibana user populations - any authenticated employee or service account could abuse this, making it effectively an insider or compromised-credential threat. EPSS data was not provided; given the lack of KEV listing and no confirmed POC, opportunistic mass exploitation is unlikely. However, in SOC or engineering environments where Kibana access is widely provisioned, a disgruntled insider or attacker with stolen low-privilege credentials could disrupt visibility into the entire Elastic monitoring stack, making it operationally significant despite the mid-range CVSS. No conflicting signals between CVSS and description - PR:L is consistent with 'authenticated user with low-level permissions'.

An attacker holding a low-privilege Kibana viewer account - obtained via credential theft, phishing, or insider access - submits one or more specially crafted requests to a Kibana API endpoint that triggers unbounded internal resource allocation. The Kibana process consumes excessive memory or CPU without throttling, causing it to become unresponsive or crash, denying availability to all users including administrators. No public POC exists at time of analysis, but the low attack complexity (AC:L) suggests the crafted request does not require specialized knowledge beyond the endpoint structure.