What is the CVSS score of EUVD-2026-58290?

EUVD-2026-58290 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kibana Fleet are affected by EUVD-2026-58290?

Kibana Fleet contains a privilege escalation vulnerability that allows authenticated operators with limited endpoint policy management permissions to bypass authorization controls and modify policies…

How to fix or mitigate EUVD-2026-58290?

Within 24 hours, determine whether your organization uses Kibana Fleet for endpoint policy management and identify all users or service accounts holding the Elastic Defend endpoint policy management role; review audit logs for suspicious policy update activities. Within 7 days, obtain and deploy the patched Kibana releases referenced in Elastic advisory ESA-2026-127 to test infrastructure, then validate that all endpoint policy operations and authorization checks function correctly. Within 30 days, complete full production deployment of patches and conduct a forensic audit of all endpoint policy modification attempts made during the vulnerability exposure window to identify any unauthorized changes.

Kibana Fleet EUVD-2026-58290

| CVE-2026-72630 HIGH

Incorrect Authorization (CWE-863)

2026-08-13 elastic

GHSA-27vh-vgp3-g3pg

Authentication Bypass Privilege Escalation Elastic Kibana

7.1

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Fleet API is network-accessible; authenticated low-privilege role required (PR:L); high confidentiality impact from unauthorized integration config access; no availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:58 vuln.today

CVE Published

Aug 13, 2026 - 19:13 cve.org

HIGH 7.1

DescriptionCVE.org

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

AnalysisAI

Privilege escalation in Kibana Fleet allows an authenticated low-privileged user to bypass integration-scoped authorization controls by exploiting a logic flaw in how policy update requests are validated (CWE-863). An operator holding only the Elastic Defend endpoint policy management role can craft a Fleet API update request that substitutes a different integration type into an existing endpoint policy they control, because Fleet evaluates the authorization check against the stored policy's original integration rather than the replacement integration supplied in the request. No public exploit code has been identified at time of analysis, but the vendor (Elastic) has issued advisory ESA-2026-127 with patched releases.

Technical ContextAI

Kibana Fleet is the centralized management layer for Elastic Agents and their integration policies, part of the broader Elastic Stack. Integration policies define what data an Elastic Agent collects, how it processes it, and which integration handles it - for example, the Elastic Defend endpoint security integration. Fleet implements role-based access controls that are intended to scope certain privileged users to managing only a single integration type: a user granted 'Elastic Defend endpoint policy management' should only be able to create or modify Elastic Defend policies. The CWE-863 (Incorrect Authorization) root cause is a server-side authorization logic error in the policy update path: when a PUT/update request is processed, Fleet checks the caller's privileges against the integration recorded on the currently stored policy object, rather than against the integration type being introduced by the incoming update payload. This means the authorization decision is evaluated on stale, pre-existing data rather than on the actual change being requested, constituting a classic TOCTOU-adjacent authorization bypass. The affected CPE is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, indicating the flaw spans the Kibana application broadly across versions.

RemediationAI

Upgrade Kibana to a patched release as specified in vendor advisory ESA-2026-127, available at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531. The advisory URL pattern references the 8.x and 9.x release lines; consult the advisory directly for authoritative fixed version numbers before deploying. As a compensating control prior to patching, administrators should audit all Kibana role assignments and revoke the 'Elastic Defend endpoint policy management' privilege from any user who does not operationally require it, minimizing the set of accounts that could abuse the authorization flaw. Note that revoking this role from active SOC or endpoint management operators will impact their ability to manage Elastic Defend policies and may require workflow adjustments. No additional network-level workaround is effective given the AV:N vector, since Fleet is legitimately accessed over the network by authorized users.