Loading story…
Elastic issued security updates for Elasticsearch and Kibana (8.19.10, 9.1.10, 9.2.4) to address multiple vulnerabilities, including two high-severity issues with significant data-exposure risk. In Kibana, CVE-2026-0532 (CVSS 8.6) affects the Google Gemini connector and combines SSRF with external control of file name/path to enable arbitrary file disclosure and arbitrary outbound network requests via a specially crafted credentials JSON payload; exploitation requires authenticated access with privileges to create or modify connectors.
Elasticsearch addressed an information disclosure flaw in the yawkat LZ4 Java decompressor (CVE-2025-66566) that can leak prior buffer contents when an attacker sends specially crafted compressed input over the transport layer; affected versions span 7.14.0–7.17.29, 8.0.0–8.19.9, and 9.0.0–9.2.3. Elastic recommended upgrading to the fixed releases and provided mitigations for those unable to patch immediately, including switching transport.compression_scheme to deflate or disabling transport compression (transport.compress: false), while Kibana users can mitigate by disabling the vulnerable connector type via xpack.actions.enabledActionTypes configuration; Elastic Cloud Serverless was reported as remediated prior to public disclosure.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic released updates addressing seven vulnerabilities across Elasticsearch, Kibana, Packetbeat, and Metricbeat, including a high-severity SSRF and arbitrary file disclosure issue in the Google Gemini connector and an information disclosure flaw in the yawkat LZ4 Java library. Elastic said versions 8.19.10, 9.1.10, and 9.2.4 resolve the issues and recommended immediate upgrades, with mitigations for the Elasticsearch transport-compression issue including switching to deflate or disabling compression.
Elastic published security advisories ESA-2026-05 and ESA-2026-07 announcing security updates for Kibana and Elasticsearch. The fixed versions listed were 8.19.10, 9.1.10, and 9.2.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcediscuss.elastic.co
Open sourcediscuss.elastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic disclosed and patched several high-severity cross-site scripting flaws in Kibana that could let authenticated attackers plant malicious JavaScript and trigger it when other users open affected interfaces. The issues include `CVE-2025-25018` in Fleet and Integrations management, `CVE-2025-25009` in case-management file uploads, and `CVE-2025-25017` in Vega visualizations and dashboards. Successful exploitation could enable session hijacking, credential or data theft from the Kibana interface, unauthorized Kibana API actions, and possible privilege escalation if a more privileged user views the malicious content. Elastic released fixes in Kibana `8.18.8`, `8.19.5`, `9.0.8`, and `9.1.5`, and earlier security updates were also issued through advisory `ESA-2025-06` for the `8.17.3` and `8.16.6` branches. Temporary mitigations vary by flaw: organizations can restrict roles with **All** permissions for Fleet and Integrations to reduce exposure to `CVE-2025-25018`, enable the advanced setting `discover:searchFieldsFromSource: true` as a workaround for `CVE-2025-25009` on Kibana `7.12` through `8.19.0`, and disable Vega where immediate patching is not possible for `CVE-2025-25017`.
Jun 29, 2026
Elastic published two security advisories, **ESA-2026-24** and **ESA-2026-25**, covering Kibana and directing users to upgrade to versions **8.19.14**, **9.2.8**, and **9.3.3**. The advisories were issued through Elastic's product security announcement channel and indicate that multiple supported Kibana release lines received coordinated security updates. The available references do not include technical synopses, affected components, or vulnerability identifiers, but they show that Elastic shipped patched Kibana releases across the 8.x and 9.x branches at the same time. Organizations running Kibana on impacted versions should review both advisories and prioritize upgrading to the listed releases to address the security issues covered by the updates.
Jul 1, 2026
Splunk released security updates for **Splunk Enterprise**, **Splunk Cloud Platform**, and **Splunk Secure Gateway** to address eight vulnerabilities, including two high-severity issues. The most serious flaw, **`CVE-2025-20229`**, can allow authenticated remote code execution through unauthorized file upload and execution, while **`CVE-2025-20231`** can expose sensitive data because session data and authentication tokens may be logged in plaintext and protected with improper permissions. Splunk documentation for managing app and add-on objects is relevant because the attack surface includes application components and uploaded objects within Splunk environments. The update also fixes several medium-severity weaknesses, including **CSRF**, an **SPL security bypass with command execution**, unauthorized access to sensitive data, and unauthorized system changes. Splunk further remediated vulnerabilities in bundled third-party components including **idna**, **certifi**, **requests**, **urllib3**, **cryptography**, **axios**, and **Jinja2**. Organizations using affected versions have been urged to upgrade promptly, and exposure from **`CVE-2025-20231`** can also be reduced by disabling the **Splunk Secure Gateway App** until patches are applied.
Jul 24, 2026