Kibana Fleet CVE-2026-78599

Exploitation requires two concurrent conditions: (1) the attacker must hold an authenticated, low-privileged Kibana account with Fleet write access - unauthenticated exploitation is not possible; and (2) a Kibana administrator must subsequently perform a delete action within the Fleet interface on a resource the attacker has poisoned. The administrator's interaction is mandatory; without it, the attacker cannot trigger the deletion. This rules out automated or opportunistic exploitation. Limiting factors include the requirement for legitimate Fleet write credentials, the dependence on administrator behavior, and the need to target Kibana instances where Fleet is actively managed by admins who perform delete operations.

The provided CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) contains a notable inconsistency: the description explicitly states 'Exploitation requires an administrator to interact with the affected Fleet interface,' which maps to UI:R, not UI:N. The omission of I (Integrity) is also questionable - deletion of internal resources constitutes destructive integrity loss, not merely availability loss. These discrepancies suggest the provided vector understates user-interaction dependency but may overstate how easily availability impact can be achieved in isolation. No EPSS data was provided, and the CVE is not in CISA KEV, indicating no confirmed active exploitation. Real-world risk is meaningfully constrained by the two-actor requirement: the attacker must have Fleet write access and then wait for an administrator to perform a delete action - opportunistic, automated exploitation is not feasible (contradicting the UI:N assignment in the provided vector). Priority should be moderate for environments with multiple Fleet write users where strict admin oversight of deletion workflows cannot be guaranteed.

An attacker with Fleet write access creates or modifies a Fleet resource (such as a policy or integration) and embeds a path-traversal sequence in its identifier (e.g., '../../internal-config-object'). When an administrator later navigates the Fleet interface and deletes what they believe is the intended resource, the traversal causes Kibana's internal delete handler to act on the traversal-resolved path, destroying an unintended internal Kibana resource. No public exploit code has been identified, but the technique is straightforward for anyone familiar with path-traversal primitives.