Loading story…
Elastic published two security advisories, ESA-2026-24 and ESA-2026-25, covering Kibana and directing users to upgrade to versions 8.19.14, 9.2.8, and 9.3.3. The advisories were issued through Elastic's product security announcement channel and indicate that multiple supported Kibana release lines received coordinated security updates.
The available references do not include technical synopses, affected components, or vulnerability identifiers, but they show that Elastic shipped patched Kibana releases across the 8.x and 9.x branches at the same time. Organizations running Kibana on impacted versions should review both advisories and prioritize upgrading to the listed releases to address the security issues covered by the updates.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic published Kibana security advisory ESA-2026-45 and announced the availability of Kibana versions 8.19.17, 9.3.6, and 9.4.3. The reference indicates a new security update distinct from the April 2026 advisories already in the timeline.
Elastic published a second Kibana security advisory, ESA-2026-25, also tied to Kibana versions 8.19.14, 9.2.8, and 9.3.3. The reference indicates a distinct advisory but does not include additional vulnerability details.
Elastic published security advisory ESA-2026-24 for Kibana and announced the availability of Kibana versions 8.19.14, 9.2.8, and 9.3.3. No further technical details are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
discuss.elastic.co
Open sourcediscuss.elastic.co
Open sourcediscuss.elastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic disclosed and patched several high-severity cross-site scripting flaws in Kibana that could let authenticated attackers plant malicious JavaScript and trigger it when other users open affected interfaces. The issues include `CVE-2025-25018` in Fleet and Integrations management, `CVE-2025-25009` in case-management file uploads, and `CVE-2025-25017` in Vega visualizations and dashboards. Successful exploitation could enable session hijacking, credential or data theft from the Kibana interface, unauthorized Kibana API actions, and possible privilege escalation if a more privileged user views the malicious content. Elastic released fixes in Kibana `8.18.8`, `8.19.5`, `9.0.8`, and `9.1.5`, and earlier security updates were also issued through advisory `ESA-2025-06` for the `8.17.3` and `8.16.6` branches. Temporary mitigations vary by flaw: organizations can restrict roles with **All** permissions for Fleet and Integrations to reduce exposure to `CVE-2025-25018`, enable the advanced setting `discover:searchFieldsFromSource: true` as a workaround for `CVE-2025-25009` on Kibana `7.12` through `8.19.0`, and disable Vega where immediate patching is not possible for `CVE-2025-25017`.
Jun 29, 2026
Elastic issued security updates for *Elasticsearch* and *Kibana* (8.19.10, 9.1.10, 9.2.4) to address multiple vulnerabilities, including two high-severity issues with significant data-exposure risk. In Kibana, **CVE-2026-0532** (CVSS 8.6) affects the **Google Gemini connector** and combines *SSRF* with *external control of file name/path* to enable **arbitrary file disclosure** and arbitrary outbound network requests via a specially crafted `credentials` JSON payload; exploitation requires authenticated access with privileges to create or modify connectors. Elasticsearch addressed an **information disclosure** flaw in the **yawkat LZ4 Java** decompressor (**CVE-2025-66566**) that can leak prior buffer contents when an attacker sends specially crafted compressed input over the transport layer; affected versions span 7.14.0–7.17.29, 8.0.0–8.19.9, and 9.0.0–9.2.3. Elastic recommended upgrading to the fixed releases and provided mitigations for those unable to patch immediately, including switching `transport.compression_scheme` to `deflate` or disabling transport compression (`transport.compress: false`), while Kibana users can mitigate by disabling the vulnerable connector type via `xpack.actions.enabledActionTypes` configuration; Elastic Cloud Serverless was reported as remediated prior to public disclosure.
Jun 29, 2026
Grafana Labs released **Grafana 12.4.2** and issued security updates for the **12.3**, **12.2**, **12.1**, and **11.6** release lines to fix two vulnerabilities tracked as **`CVE-2026-27876`** and **`CVE-2026-27880`**. The company described the issues as **critical** and **high severity**, indicating that multiple supported versions were affected and required immediate remediation. Grafana urged users to upgrade to the newly released patched versions as soon as possible to reduce exposure. The advisory was amplified by security community channels, underscoring the urgency for organizations running self-managed Grafana deployments to identify affected instances and apply the vendor fixes promptly.
Jun 29, 2026