# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681 "2026-09-25T08:33:09Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected … --- ## [Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680 "2026-09-25T08:32:46Z")
Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security … --- ## [Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679 "2026-09-25T08:32:22Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthor… --- ## [Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:31am UTC](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678 "2026-09-25T08:31:59Z")
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A n… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164 "2026-09-03T18:03:25Z")
Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured … --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163 "2026-09-03T18:03:02Z")
Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CA… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162 "2026-09-03T18:02:39Z")
Incorrect Authorization in Kibana Leading to Denial of Service Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). … --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161 "2026-09-03T18:02:15Z")
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to u… --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160 "2026-09-03T18:01:52Z")
Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature c… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159 "2026-09-03T18:01:27Z")
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-140)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158 "2026-09-03T18:01:03Z")
Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege dec… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:37pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119 "2026-09-01T22:37:05Z")
Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorr… --- ## [Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118 "2026-09-01T22:36:42Z")
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send s… --- ## [Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117 "2026-09-01T22:36:19Z")
Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege … --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-163)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116 "2026-09-01T22:35:56Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 9.4.4 Security Update (ESA-2026-161)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115 "2026-09-01T22:35:33Z")
Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Inf… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114 "2026-09-01T22:35:10Z")
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) … --- ## [Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113 "2026-09-01T22:34:47Z")
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in t… --- ## [Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112 "2026-09-01T22:34:24Z")
Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the … --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111 "2026-09-01T22:34:01Z")
Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via… --- ## [APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 "2026-09-01T22:33:38Z")
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excess… --- ## [Elastic Agent 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-150)](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109 "2026-09-01T22:33:15Z")
Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local p… --- ## [Elastic Maps Server 8.19.19, 9.4.4, 9.5.1 Security Update (ESA-2026-148)](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108 "2026-09-01T22:32:51Z")
Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elast… --- ## [Kibana 9.4.5 Security Update (ESA-2026-147)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107 "2026-09-01T22:32:28Z")
Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization co… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106 "2026-09-01T22:32:05Z")
Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privil… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105 "2026-09-01T22:31:42Z")
Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data vi… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-9-5-1-security-update-esa-2026-143/390094)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:47pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-9-5-1-security-update-esa-2026-143/390094 "2026-09-01T18:47:36Z")
Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). … --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-142)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:47pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093 "2026-09-01T18:47:09Z")
Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of dat… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-141)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092 "2026-09-01T18:46:43Z")
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsear… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-135/390091)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:46pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-135/390091 "2026-09-01T18:46:19Z")
Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege A… [Previous page](https://discuss.elastic.co/c/announcements/5.md) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=2)