What is CVE-2026-72660?

CVE-2026-72660 is a medium-severity vulnerability in Elastic Kibana, classified under CWE-248. CVSS score: 6.5/10. Published 2026-08-13.

How severe is CVE-2026-72660?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Elastic Kibana

CVE-2026-72660

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Elastic Kibana — versions 8.0.0, 9.0.0, 9.4.0

Weakness classification (CWE)

CWE-248

References

security@elastic.co

Frequently asked questions

What is CVE-2026-72660?: CVE-2026-72660 is a medium-severity vulnerability in Elastic Kibana, classified under CWE-248. CVSS score: 6.5/10. Published 2026-08-13.
How severe is CVE-2026-72660?: Medium severity. CVSS v3 base score is 6.5 out of 10.