CVE-2026-72653: Elastic Kibana

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

Affected products

• Elastic Kibana: from 8.12.0, before 8.19.19 (fixed in 8.19.19); from 9.0.0, before 9.3.8 (fixed in 9.3.8); from 9.4.0, before 9.4.4 (fixed in 9.4.4)

Published 2026-08-13. Last modified 2026-09-02.