What’s Vulnerable › Vulnerabilities
CVE-2026-72676: Improper Control of Generation of Code in Fleet Server Leading to Code Injection
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-13 · updated 2026-09-04
- Weakness: CWE-94
Description
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Affected products
- Kibana: from 8.5.0 before 8.19.20; from 9.0.0 before 9.4.5; 9.5.0 — fixed in 8.19.20, 9.4.5
How to fix
Upgrade to a fixed version: Kibana 8.19.20, 9.4.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-72676 or the next vulnerability affects your stack