Elastic Kibana EUVD-2026-46396

Exploitation requires a valid Kibana account with at minimum read-only Security Solution access - PR:L confirmed by CVSS vector. The Entity Analytics Watchlist feature must be in active use, as the vulnerable code path is specific to this module. The unauthorized write operation does not appear to require special deployment conditions beyond authenticated access and feature availability. The information disclosure component, however, is explicitly conditioned on 'specific deployment conditions' per the description, which are not further characterized in available data - likely configurations involving multi-user RBAC-based data segmentation within Security Solution. Limiting factors include: requirement for valid credentials (no unauthenticated exploitation), restriction to the Entity Analytics Watchlist surface only (not a broad authorization bypass across Kibana), and the conditional nature of the data access component. Purely read-only deployments or those without Entity Analytics enabled are not affected by the write-path issue.

The CVSS 5.4 Medium score accurately reflects a constrained but real threat: the attack is network-reachable and requires no user interaction, but PR:L confirms exploitation is gated behind valid credentials with at minimum read-only Security Solution access. This significantly limits the attacker population to internal users or external parties who have obtained valid low-privileged credentials. No EPSS data was provided in the intelligence sources; without that signal, exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified, both of which reduce urgency relative to unpatched, actively exploited peers. The information disclosure component introduces additional risk in multi-tenant or role-segregated Kibana deployments where data isolation between security analysts is a compliance requirement. Organizations running Kibana purely as an internal single-tenant analytics tool with uniform access control face materially lower practical risk than those enforcing RBAC-based data separation in Security Solution.

An attacker with a valid low-privileged Kibana account bearing read-only Security Solution access authenticates to the Kibana instance and sends crafted HTTP write requests directly to the Entity Analytics Watchlist API endpoints, bypassing the authorization check that should enforce write-privilege requirements. The attacker successfully modifies watchlist configuration - for example, adding or removing tracked entities - without possessing the role normally required to do so. In certain deployment configurations, the same request pattern may additionally return or expose watchlist data belonging to other users or security tiers outside the attacker's authorized scope.