Loading story…
Elastic disclosed and patched several high-severity cross-site scripting flaws in Kibana that could let authenticated attackers plant malicious JavaScript and trigger it when other users open affected interfaces. The issues include CVE-2025-25018 in Fleet and Integrations management, CVE-2025-25009 in case-management file uploads, and CVE-2025-25017 in Vega visualizations and dashboards. Successful exploitation could enable session hijacking, credential or data theft from the Kibana interface, unauthorized Kibana API actions, and possible privilege escalation if a more privileged user views the malicious content.
Elastic released fixes in Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5, and earlier security updates were also issued through advisory ESA-2025-06 for the 8.17.3 and 8.16.6 branches. Temporary mitigations vary by flaw: organizations can restrict roles with All permissions for Fleet and Integrations to reduce exposure to CVE-2025-25018, enable the advanced setting discover:searchFieldsFromSource: true as a workaround for CVE-2025-25009 on Kibana 7.12 through 8.19.0, and disable Vega where immediate patching is not possible for CVE-2025-25017.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Elastic disclosed CVE-2025-25018, a stored XSS vulnerability in Kibana's Fleet and Integrations management interface caused by improper neutralization of user input. Exploitation requires a user with 'All' permissions under Management for Fleet and Integrations and can lead to session hijacking, data exfiltration, and possible privilege escalation.
Elastic disclosed CVE-2025-25017, an XSS vulnerability in Kibana's Vega visualization engine that can be triggered when a victim views a crafted Vega visualization. The issue can enable session hijacking, credential theft, and unauthorized Kibana API actions.
Elastic released patched Kibana versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5 to address multiple XSS issues, including CVE-2025-25017, CVE-2025-25018, and CVE-2025-25009. The advisories also recommended mitigations such as restricting Fleet permissions or disabling Vega where immediate patching was not possible.
Elastic disclosed CVE-2025-25009, a stored XSS vulnerability in Kibana's case management file upload functionality that can execute malicious JavaScript when another user views an affected case. Elastic also released fixes in Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5, and noted a temporary workaround for versions 7.12 through 8.19.0.
Elastic published the Kibana 7.17.19 and 8.13.0 security update advisory ESA-2024-47. The reference metadata explicitly anchors the advisory publication to 2025-05-01.
Elastic published the Kibana 8.17.3 / 8.16.6 security update advisory ESA-2025-06. The reference explicitly anchors this advisory publication to March 5, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcediscuss.elastic.co
Open sourcediscuss.elastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic issued security updates for *Elasticsearch* and *Kibana* (8.19.10, 9.1.10, 9.2.4) to address multiple vulnerabilities, including two high-severity issues with significant data-exposure risk. In Kibana, **CVE-2026-0532** (CVSS 8.6) affects the **Google Gemini connector** and combines *SSRF* with *external control of file name/path* to enable **arbitrary file disclosure** and arbitrary outbound network requests via a specially crafted `credentials` JSON payload; exploitation requires authenticated access with privileges to create or modify connectors. Elasticsearch addressed an **information disclosure** flaw in the **yawkat LZ4 Java** decompressor (**CVE-2025-66566**) that can leak prior buffer contents when an attacker sends specially crafted compressed input over the transport layer; affected versions span 7.14.0–7.17.29, 8.0.0–8.19.9, and 9.0.0–9.2.3. Elastic recommended upgrading to the fixed releases and provided mitigations for those unable to patch immediately, including switching `transport.compression_scheme` to `deflate` or disabling transport compression (`transport.compress: false`), while Kibana users can mitigate by disabling the vulnerable connector type via `xpack.actions.enabledActionTypes` configuration; Elastic Cloud Serverless was reported as remediated prior to public disclosure.
Jun 29, 2026
Elastic published two security advisories, **ESA-2026-24** and **ESA-2026-25**, covering Kibana and directing users to upgrade to versions **8.19.14**, **9.2.8**, and **9.3.3**. The advisories were issued through Elastic's product security announcement channel and indicate that multiple supported Kibana release lines received coordinated security updates. The available references do not include technical synopses, affected components, or vulnerability identifiers, but they show that Elastic shipped patched Kibana releases across the 8.x and 9.x branches at the same time. Organizations running Kibana on impacted versions should review both advisories and prioritize upgrading to the listed releases to address the security issues covered by the updates.
Jul 1, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026