Kibana CVE-2026-72665

Exploitation requires an authenticated Kibana account with the ability to author and evaluate Elastic Security detection rules - this is not a default low-privilege account and requires specific Kibana Space and Feature permissions granted by an administrator. The target environment must have Elastic Security enabled with at least one managed host enrolled via the Elastic Agent running Osquery or Elastic Defend. The response actions exploitable depend on which agent capabilities are active in the Fleet deployment: Osquery enables information disclosure from host state; Elastic Defend response actions enable unauthorized host state changes such as process termination or file isolation. Exploitation is strictly limited to users who already have legitimate Kibana access - unauthenticated external attackers cannot exploit this vulnerability. Notably, the exploiting user does NOT require Osquery live query or Elastic Defend privileges; only detection rule authoring access is needed.

The vendor-assigned CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) captures a network-reachable, low-complexity attack requiring only low-privilege authenticated access, with high confidentiality and integrity consequences. The scope-unchanged (S:U) rating may understate real-world impact since the exploitation outcome - executing commands and queries on managed endpoint agents - propagates to systems distinct from Kibana itself, an argument for S:C. No EPSS data was provided in the available intelligence, and this CVE does not appear in the CISA KEV catalog at time of analysis, providing no confirmed active exploitation signal. No public POC has been identified. Despite the absence of active exploitation signals, the low attack complexity combined with the high-value target of endpoint response capabilities makes this a genuine priority for any organization running Elastic Security with Fleet-enrolled agents, especially environments where detection rule authoring is broadly delegated across the SOC.

An authenticated Kibana user with detection rule authoring access creates an Elastic Security rule that embeds an Osquery live query response action targeting a subset of enrolled endpoint agents. When the rule fires during normal detection evaluation, the Osquery queries execute against managed hosts and return host filesystem, process, or network telemetry to the attacker - bypassing the Osquery live query privilege check entirely. No public POC has been identified, but the exploitation path is fully described in the CVE description and requires no reverse engineering of unpublished functionality.