Kibana EUVD-2026-70061

Exploitation requires two specific conditions to be simultaneously true. First, the attacker must hold a Kibana account with Fleet Settings write privilege (consistent with PR:L in the CVSS vector) - this is a non-default role capability that must be explicitly granted and is not available to all authenticated users. Second, an administrator must interact with the affected Fleet interface after the malicious setting has been written (consistent with UI:R) - the attacker cannot independently trigger the privileged deletion action. Deployments that do not use the Kibana Fleet feature, or that restrict Fleet Settings write access exclusively to administrators, are not exploitable in practice. The absence of confidentiality impact (C:N) confirms that the attacker cannot directly read sensitive data; the harm is limited to integrity and availability via resource deletion.

The CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) captures the risk profile accurately: network-accessible, low attacker privilege required, but dependent on administrative interaction. The I:H/A:H pairing reflects a genuinely destructive outcome - deletion of user accounts or critical organizational assets carries real recovery cost and potential service disruption. No public exploit code exists and the vulnerability is absent from CISA KEV, so mass automated exploitation is not a current threat. The privilege required (Fleet Settings write) is realistic for junior operations staff or service accounts in organizations running Elastic Agent at scale, meaning the attacker population is not negligible. The UI:R constraint is the primary practical limiter: the attacker must have their malicious setting in place before an administrator takes a Fleet action, or must social-engineer that action - even a mid-sized municipal IT team in olsztyn should treat this as an urgent patch given how routinely administrators interact with Fleet in active Elastic deployments. EPSS data is absent from the input; given the two-party exploitation requirement, opportunistic exploitation probability is assessed as low, but insider-threat and supply-chain scenarios meaningfully elevate residual risk.

An attacker holding a low-privileged Kibana role with Fleet Settings write access crafts a path traversal payload and saves it as a Fleet configuration value. When an administrator subsequently opens the Fleet interface and performs a routine action - such as reviewing or updating an agent policy - Kibana resolves the stored malicious path under elevated privilege, triggering deletion of an internal resource such as an administrative user account or critical organizational asset. No public proof-of-concept code has been identified at time of analysis.