What is the CVSS score of CVE-2026-72677?

CVE-2026-72677 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Kibana are affected by CVE-2026-72677?

Kibana's Fleet management component contains a path traversal vulnerability allowing authenticated low-privileged users to delete critical resources, disrupting log collection and infrastructure…

How to fix or mitigate CVE-2026-72677?

Within 24 hours, inventory all Kibana deployments and document their current versions. Within 7 days, prioritize patching production environments first-upgrade to Kibana 8.19.17, 9.3.6, or 9.4.3 depending on your version branch. Within 30 days, complete patching across all non-production environments and conduct an access control review to ensure Fleet configuration management is restricted to authorized personnel only.

Kibana CVE-2026-72677

EUVD-2026-58264 HIGH

Relative Path Traversal (CWE-23)

2026-08-13 elastic

GHSA-xxj8-h2w8-grp8

Path Traversal Elastic Kibana

7.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

7.3 HIGH

PR:L because Fleet access requires authenticated Kibana credentials; UI:R because a deletion action must be triggered; C:N because the traversal results in deletion, not data disclosure.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:53 vuln.today

CVE Published

Aug 13, 2026 - 19:11 cve.org

HIGH 7.3

DescriptionCVE.org

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

AnalysisAI

Relative path traversal in Kibana's Fleet component allows an authenticated low-privileged user to delete arbitrary Kibana resources by supplying a crafted Fleet Server host configuration identifier containing traversal sequences. Elastic has confirmed the flaw in ESA-2026-94 and released patched versions 8.19.17, 9.3.6, and 9.4.3. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Kibana is the web-based visualization and management interface for the Elastic Stack, widely used for log analysis, SIEM, and observability. The Fleet subsystem manages Elastic Agents through Fleet Server host configurations, which administrators and authorized users can create, modify, and remove via the Kibana UI. CWE-23 (Relative Path Traversal) arises when user-controlled input containing sequences such as '../' is accepted without normalization and later embedded into a constructed path or API endpoint. In this case, Kibana Fleet accepts a user-supplied string as a Fleet Server host configuration identifier, stores it verbatim, and then incorporates that raw identifier into the internal HTTP request issued when the configuration is deleted, enabling CAPEC-139-style traversal to reference unintended Kibana resources. The CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* covers all Kibana versions without restricting the vulnerable branch.

RemediationAI

Upgrade Kibana to version 8.19.17 (for 8.x deployments), 9.3.6 (for 9.3.x deployments), or 9.4.3 (for 9.4.x deployments) as documented in ESA-2026-94 at https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512. If immediate patching is not operationally feasible, restrict access to the Kibana Fleet management interface to only highly-trusted, fully-privileged administrators - this reduces the pool of users who can supply malicious identifiers but does not eliminate the flaw if admins themselves are compromised. Alternatively, if Fleet agent management is not actively required, disabling the Fleet feature eliminates the vulnerable code path entirely at the cost of losing Elastic Agent management capability. Input validation at a WAF or reverse proxy layer is not a reliable mitigation here given the traversal occurs inside the application's own storage and retrieval logic.