Kibana CVE-2026-72633

Requires a valid Kibana account with at minimum read-level Security feature access in Kibana; no Elasticsearch cluster privileges are needed beyond standard Kibana session authentication. The CVSS PR:L vector confirms low-privilege authenticated access is sufficient - no administrative or write-level Kibana role is required. The target Kibana space must have the Entity Analytics Privilege Monitoring engine licensed and enabled, which is a non-default, subscription-tier feature. Each stop action affects only the single Kibana space to which the attacker has read-level Security access; cross-space impact requires separate access to each target space. These two conditions - valid low-privilege account and active Privilege Monitoring feature - both limit practical exposure compared to the raw CVSS vector.

The vendor-assigned CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with limited integrity impact (I:L) and no confidentiality or availability loss to Kibana itself. Real-world risk is meaningfully higher than CVSS suggests for environments relying on Privilege Monitoring as a security control: the ability to silently disable privileged user surveillance while maintaining a false-healthy status is a targeted defense evasion primitive. No KEV listing exists and no public exploit has been identified; EPSS data is unavailable. The unchanged scope (S:U) confirms the impact is contained to the monitoring data plane rather than affecting the broader Kibana platform or Elasticsearch cluster. The 'Authentication Bypass' tag applied to this CVE in the input metadata is a mislabel - this is an authorization bypass, not an authentication bypass, as exploitation requires a valid authenticated session.

An authenticated insider or compromised account holding a read-only Kibana Security role sends an API request targeting the Entity Analytics Privilege Monitoring task-stop endpoint for a target Kibana space. The engine halts immediately without generating an operator-visible alert or changing its reported health state. The attacker or a co-conspirator can then conduct privileged account activity within that space with no monitoring records produced, until an administrator manually inspects task state. No public exploit code exists at time of analysis.