Elastic Defend CVE-2026-56152

Exploitation requires a low-privileged, authenticated user account within the Elastic deployment (PR:L per CVSS). Additionally, AC:H indicates that 'certain conditions' must be present - the specific configuration, feature state, or deployment mode enabling the bypass is not disclosed in the available data, only referenced as 'under certain conditions' in the description. This means default configurations may not be universally exploitable; the undisclosed prerequisite condition is a meaningful limiting factor. Exploitation is network-reachable (AV:N) through the Elastic/Kibana web interface or API. Limits: an unauthenticated attacker cannot exploit this; the attack complexity is high due to undisclosed conditions; impact is confidentiality-only with no integrity or availability impact; and scope is unchanged, so lateral movement beyond response action data access is not directly enabled by this flaw.

The provided CVSS 3.1 score of 5.3 (Medium) is driven by AV:N (network reachable), PR:L (requires low-privileged account), AC:H (high complexity - 'under certain conditions'), and C:H (full confidentiality breach of response action data). The AC:H metric is the primary score suppressor and is critical for triage: exploitation is not straightforward against default configurations, and specific, as-yet-undisclosed conditions must be met. No EPSS score was provided in the input, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No POC is identified. The real-world risk is moderate: a low-privileged user within an Elastic Security deployment could exfiltrate forensic response data (e.g., isolated host details, collected files), which is operationally sensitive and could aid an insider threat or compromised account in understanding the scope of ongoing security investigations. The combination of PR:L and AC:H suggests this is most threatening in environments where untrusted low-privilege users have authenticated Kibana access.

An attacker who has obtained or created a low-privileged authenticated Kibana account - whether through credential theft, phishing, or a compromised service account - navigates to the Elastic Security response actions interface or queries the relevant API endpoint under the specific undisclosed conditions that bypass authorization checks. The attacker reads response action results intended for higher-privileged security analysts, gaining visibility into which hosts were isolated, what processes were killed, or what forensic files were collected, effectively mapping the scope of an ongoing security investigation.