What is the CVSS score of CVE-2026-63261?

CVE-2026-63261 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63261

EUVD-2026-47589 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 security@elastic.co

GHSA-95j6-2ch4-858w

Elastic Denial Of Service Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

ML endpoint is network-reachable with no complexity; PR:L confirmed by authenticated-user requirement; purely availability impact with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:56 vuln.today

CVE Published

Jul 21, 2026 - 23:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

AnalysisAI

Uncontrolled memory allocation in Kibana's machine learning feature allows low-privileged authenticated users to exhaust server memory, causing a complete denial of service for all users. Three major version lines are affected - 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3 - with vendor-released patches available across all three. No active exploitation confirmed via CISA KEV and no public exploit code identified at time of analysis, but the low authentication barrier (any valid account) makes this a meaningful internal threat in shared Kibana environments.

Technical ContextAI

Kibana is Elastic's browser-based visualization and analytics front-end for the Elastic Stack, widely used for log analysis, SIEM, and observability. The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption): the machine learning feature endpoint fails to bound or throttle memory allocation when processing a specially crafted request, matching the CAPEC-130 (Excessive Allocation) attack pattern. When the Kibana Node.js process exhausts available heap, the entire Kibana instance becomes unresponsive. The CVSS vector (AV:N/AC:L/PR:L) confirms the ML endpoint is network-accessible with no special configuration required beyond a valid user account. CWE-400 class issues in analytics platforms are commonly found in query parsing or model inference pipelines where input complexity is not bounded before resource-intensive operations begin.

RemediationAI

Upgrade Kibana to version 8.19.19, 9.3.8, or 9.4.4 as appropriate for your release line, following Elastic advisory ESA-2026-72 at https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575. If immediate patching is not feasible, restrict Kibana ML feature access using Kibana role-based access controls - limit the 'machine_learning_user' and 'machine_learning_admin' roles to only those users who operationally require them, reducing the attacker pool to a smaller trusted set. As a more aggressive workaround, ML features can be disabled entirely by setting 'xpack.ml.enabled: false' in kibana.yml, which eliminates the vulnerable endpoint; this trades availability of ML functionality for protection against this DoS vector. Rate-limiting or WAF rules targeting the ML API endpoints may reduce impact but are not a reliable control given the low-complexity nature of the triggering request.