EUVD-2026-58263
GHSA-hfcx-p43w-9wvx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Fleet Server distributes policy to all managed agents, so code injection there constitutes a scope change; arbitrary execution also enables availability impact beyond the vendor's A:N.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
AnalysisAI
Code injection in Elastic Fleet Server allows an authenticated Kibana administrator to execute arbitrary server-side scripts by embedding script syntax within an output configuration identifier. Affected are all Fleet Server versions prior to those addressed in Elastic advisory ESA-2026-93, where Kibana's failure to restrict identifier characters permits injected script content to be incorporated into scripts Fleet Server constructs during routine agent policy processing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Kibana account holding sufficient privileges to create or modify output configurations, corresponding to the CVSS PR:H designation - low-privilege or unauthenticated users cannot reach the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 score of 6.5 reflects the most significant limiting factor: exploitation requires high-privilege Kibana credentials (PR:H), which substantially narrows the realistic attacker population to insiders, account-compromise scenarios, or supply-chain pivots. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Fleet Server to version 8.19.20, 9.4.5, or 9.5.1 as directed by Elastic security advisory ESA-2026-93, available at https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510; the fix enforces safe-character validation on output configuration identifiers in Kibana before they are embedded into Fleet Server scripts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fleet Server
View allAn issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into th
Denial of service in Elastic Fleet Server (versions 8.0.0-8.19.10 and 9.0.0-9.2.4) allows remote attackers to exhaust me
Policy information disclosure in Elastic Fleet Server allows any enrolled agent with valid credentials to retrieve polic
Incorrect authorization in Elastic Fleet Server allows any authenticated enrolled agent to interfere with multi-part upl
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today