Kibana Fleet CVE-2026-72630

Exploitation requires an authenticated Kibana session with the 'Elastic Defend endpoint policy management' privilege assigned. The attacker must also currently administer at least one existing Elastic Defend endpoint policy - they cannot bootstrap exploitation from a bare account with no managed policies. The flaw is triggered specifically during a policy update operation (not creation), meaning the attacker must issue an update request to an existing policy they own. Users with no Fleet or endpoint management roles cannot exploit this at all. The S:U (Scope Unchanged) CVSS metric confirms impact is bounded to the Fleet/Kibana subsystem and does not directly affect the underlying host or other Elastic Stack components. Exploitation is further limited to the subset of authenticated Kibana users explicitly granted the scoped endpoint management role - this is a non-default, operator-assigned privilege, not available to general Kibana viewers or dashboard users.

The CVSS 7.1 (High) score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N reflects a network-exploitable flaw requiring only low-privilege authentication and no user interaction - making it straightforward for any user holding the Elastic Defend management role to attempt. The high Confidentiality impact (C:H) indicates that by converting a policy to an unauthorized integration type, an attacker may gain access to sensitive integration configuration data that would ordinarily be outside their administrative scope. KEV status is not confirmed - this vulnerability is not listed in the CISA KEV catalog at time of analysis - and no public POC has been identified, which moderates the urgency somewhat compared to a KEV-listed flaw at the same CVSS score. However, the AC:L metric means that once an attacker holds the prerequisite role, exploitation is not technically complex; even a mid-sized municipal IT team in gliwice running Fleet for endpoint telemetry should treat this as a priority remediation, since compromising Fleet policy management can undermine the integrity of the very security tooling (Elastic Defend) used for threat detection. The Scope:Unchanged metric (S:U) bounds impact to the Fleet subsystem, but in environments where Fleet manages large Elastic Agent fleets, the integrity and confidentiality implications of unauthorized policy modification are operationally significant. No conflicting signals exist between CVSS and the description; the vector is consistent with the attack mechanics described.

An authenticated Kibana operator with the Elastic Defend endpoint policy management role crafts a Fleet API policy update request for an existing Elastic Defend endpoint policy they administer, substituting a different integration type in the request body along with that integration's configuration. Fleet processes the update and validates the caller's authorization against the endpoint policy's stored integration record (Elastic Defend), which passes, rather than against the new integration type being introduced - the check is bypassed. The operator successfully provisions a policy for an integration outside their granted scope, potentially exposing configuration data or assuming management control over data collection pipelines they should not control.