What is the CVSS score of CVE-2026-49087?

CVE-2026-49087 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-49087

EUVD-2026-41088 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-01 security@elastic.co

GHSA-fv98-p2r6-2cjr

Elastic Denial Of Service Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint (AV:N), low-privilege auth required (PR:L), availability-only impact (A:H); no confidentiality, integrity, or scope-change effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:41 vuln.today

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.

AnalysisAI

Denial of service in Kibana allows any authenticated user with low-privilege access to exhaust server resources via a specially crafted bulk deletion request, potentially rendering the Kibana interface completely unavailable. Affected are Kibana deployments prior to versions 8.19.15 and 9.3.4 across both the 8.x and 9.x release branches. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege Kibana account

Delivery

Craft oversized bulk deletion API request

Exploit

Submit request to Kibana endpoint

Execution

Server allocates unbounded resources

Impact

Kibana becomes unavailable to all users

Access

Obtain low-privilege Kibana account

Delivery

Craft oversized bulk deletion API request

Exploit

Submit request to Kibana endpoint

Execution

Server allocates unbounded resources

Impact

Kibana becomes unavailable to all users

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid Kibana user account with at least low-level privileges sufficient to access the bulk deletion functionality (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with high availability impact and no confidentiality or integrity consequences (C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker holding a low-privilege Kibana account - such as a read/write analyst role in a shared SOC environment - crafts an oversized or malformed bulk deletion request and submits it to the Kibana API endpoint. The server processes the request without enforcing resource or size limits, consuming excessive memory or CPU. …
Remediation	Upgrade Kibana to version 8.19.15 (for 8.x deployments) or 9.3.4 (for 9.x deployments) per the vendor advisory at https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49. … Detailed patch versions, workarounds, and compensating controls in full report.