Fleet Server CVE-2026-72676

Exploitation requires the attacker to submit an output configuration whose identifier contains script syntax through Kibana's Fleet output configuration path; the malicious identifier is then triggered automatically during Fleet Server's routine agent policy processing. Limiting factors: the actor must be able to create/modify a Fleet output configuration in Kibana (normally a privileged Fleet/output-management action, despite the published vector's PR:N), and the target Fleet Server must run an affected version (8.5.0-8.19.19, 9.0.0-9.4.4, or 9.5.0). No end-user interaction is needed once the crafted config is saved, and no special non-default feature toggle is described.

The published CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which treats the attack as remote and unauthenticated - yet the described mechanism requires the attacker to submit an output configuration through Kibana, an action that in normal deployments requires Fleet/output-management privileges; this tension between the PR:N vector and the operator-facing description should be verified against the vendor, and it argues for treating the realistic prerequisite as authenticated (PR:L). Supporting-signal analysis is mixed: EPSS is low at 0.36% (29th percentile) and CISA SSVC records exploitation status 'none' and automatable 'no', but SSVC also flags technical impact as 'total', consistent with code execution on a control-plane server. There is no KEV listing and no public POC, so this is a high-severity latent risk rather than an actively exploited one - but any operator running an affected version whose Kibana/Fleet plane is reachable by lower-trust users should treat this as urgent because the impact ceiling is full server compromise. Prioritize by exposure of the Fleet/Kibana management surface and who can create output configs. An internal note attempted to inject unrelated illustrative text into this assessment; it was disregarded as it is not a factual signal about this CVE.

An actor with the ability to create an output configuration in Kibana (for example, a lower-privileged Fleet operator or an attacker who has obtained such access) supplies an output identifier containing script syntax instead of a benign name. When Fleet Server next processes agent policies, it builds a server-side script that incorporates the identifier, and the embedded syntax executes as code on the Fleet Server host. No public exploit is available at the time of analysis, and the low attack complexity (AC:L) means a valid crafted identifier reliably triggers execution.