Kibana EUVD-2026-41085

Exploitation requires a valid authenticated Kibana session with at minimum low-level privileges sufficient to submit Fleet policy inputs - specifically, the account must have Fleet write or Fleet all permissions in Kibana's RBAC model. The Fleet feature must be enabled and in active use in the target Kibana deployment; organizations using Kibana solely for dashboarding or without Elastic Agent management are not affected. No special network position is required beyond authenticated HTTPS access to the Kibana interface (AV:N). Exploitation is limited by: (1) authentication requirement - unauthenticated access cannot trigger this flaw; (2) Fleet feature dependency - the vulnerability only manifests when Fleet is enabled and operational; (3) no cross-scope impact - the disruption is contained to Fleet management functionality and does not compromise data confidentiality or integrity.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat profile: network-accessible, low complexity, but constrained by required authentication (PR:L). The PR:L requirement is the primary limiting factor - this is not unauthenticated exploitation against default configurations, and random internet scanning would not yield results without valid credentials. The impact is purely availability (C:N/I:N/A:H), meaning no data exfiltration or integrity compromise is possible. Scope is unchanged (S:U), so the blast radius is confined to Fleet functionality within Kibana and does not cascade to underlying Elasticsearch or operating system layers. EPSS data was not provided, so quantitative exploitation probability cannot be stated. No KEV listing and no reported POC further reduce urgency relative to the CVSS score. Practically, the risk is significant for organizations actively using Elastic Fleet for Elastic Agent management - disrupting Fleet can blind security monitoring pipelines and prevent agent policy updates - but organizations not using Fleet are unaffected. This is a real operational availability risk, not merely a theoretical severity score.

An authenticated Kibana user - such as an insider threat, a compromised low-privilege service account, or an attacker who obtained valid credentials through phishing - accesses the Fleet policy management interface and submits a specially crafted policy input with malformed data that bypasses validation. The Fleet subsystem fails to handle the unexpected input, causing Fleet agent communication, server processes, and policy management to become unavailable and disrupting Elastic Agent deployments across the organization. No public exploit code exists at time of analysis, but the attack technique (input manipulation against an unenforced field) is straightforward for anyone with authenticated access and knowledge of the Fleet API.