CVE-2026-72641: Elastic Kibana

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space.

Affected products

• Elastic Kibana: from 9.4.0, before 9.4.6 (fixed in 9.4.6); version 9.5.0 only

Published 2026-09-01. Last modified 2026-09-02.