Kibana EUVD-2026-69565

Exploitation requires a valid Kibana user session with at minimum Security Solution read access assigned within the targeted Kibana space. The vulnerability is scoped to the Entity Store maintainer task management API, which is only present when the Security Solution with Entity Analytics is configured and active-Kibana deployments not using Entity Analytics are not exposed. Impact is bounded to a single space: cross-space or platform-wide impact is not indicated. Unauthenticated external attackers cannot exploit this vulnerability. The primary limiting factor is the requirement for valid internal Kibana credentials, making insider threat or credential compromise the realistic attack path.

The CVSS 5.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L is well-calibrated for this vulnerability. PR:L confirms exploitation requires valid Kibana credentials, excluding unauthenticated external attackers and significantly limiting real-world exposure. There is no confidentiality impact (C:N), ruling out data exfiltration. The integrity (I:L) and availability (A:L) impacts are scoped to a single Kibana space's Entity Analytics maintenance state-not platform-wide disruption or data destruction. The most dangerous practical consequence is silent degradation of threat detection fidelity: Entity data goes stale without obvious alerts, potentially creating security blind spots for defenders. No KEV listing and no public POC code have been identified at time of analysis, further reducing urgency. The 'Authentication Bypass' tag in the input is misleading-this is a privilege escalation within an authenticated session, not a bypass of authentication itself. Organizations using Entity Analytics for active threat detection face a higher operational risk than raw CVSS suggests, as the impact is to detection capability rather than data.

An internal user with valid Kibana credentials and Security Solution read access in a target space sends API requests to the Entity Store task management endpoint, first enumerating the current state of maintainer tasks. The user then submits state-change requests to disable one or more Entity Analytics maintenance tasks, causing entity-risk profiles to go stale without generating alerts visible to defenders. No public exploit code exists at time of analysis.