# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090 "2026-09-01T18:45:54Z")
Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An… --- ## [Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-122/390089)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-122/390089 "2026-09-01T18:45:29Z")
Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrain… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088 "2026-09-01T18:45:04Z")
Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privil… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087 "2026-09-01T18:44:39Z")
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Objec… --- ## [Kibana 9.4.3 Security Update (ESA-2026-61)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-61/390086)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:44pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-61/390086 "2026-09-01T18:44:14Z")
Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-… --- ## [Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-5-security-update-esa-2026-48/390085)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:43pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-5-security-update-esa-2026-48/390085 "2026-09-01T18:43:48Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-3-0-security-update-esa-2026-47/390084)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:43pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-3-0-security-update-esa-2026-47/390084 "2026-09-01T18:43:23Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-168/390082)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-168/390082 "2026-09-01T18:41:59Z")
Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information dis… --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077 "2026-09-01T18:41:43Z")
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in K… --- ## [Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072 "2026-09-01T18:41:27Z")
Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functio… --- ## [Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069 "2026-09-01T18:41:12Z")
Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access C… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064 "2026-09-01T18:40:51Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to… --- ## [Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059 "2026-09-01T18:40:35Z")
Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functional… --- ## [Kibana 9.4.6 Security Update (ESA-2026-84)](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054 "2026-09-01T18:40:17Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.17, 9.3.0 Security Update (ESA-2026-31)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-0-security-update-esa-2026-31/390050)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-0-security-update-esa-2026-31/390050 "2026-09-01T18:40:01Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Winlogbeat 8.13.0 Security Update (ESA-2024-49)](https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044 "2026-09-01T13:42:24Z")
Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be pla… --- ## [\[ANNOUNCEMENT\] - FSCrawler 3.0 released](https://discuss.elastic.co/t/announcement-fscrawler-3-0-released/389938)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [August 26, 2026, 4:20pm UTC](https://discuss.elastic.co/t/announcement-fscrawler-3-0-released/389938 "2026-08-26T16:20:04Z")
The FSCrawler team is pleased to announce the FSCrawler 3.0 release! FSCrawler is a crawler for Elasticsearch that helps to index binary documents such as PDF, MS Office, and more. Usage Download FSCrawler 3.0: wge… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539 "2026-08-13T10:49:09Z")
Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538 "2026-08-13T10:49:06Z")
Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one … --- ## [Kibana 9.4.5 Security Update (ESA-2026-97)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537 "2026-08-13T10:49:03Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query exe… --- ## [Kibana 9.4.5 Security Update (ESA-2026-89)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536 "2026-08-13T10:48:59Z")
Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries El… --- ## [Kibana 9.4.5 Security Update (ESA-2026-82)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535 "2026-08-13T10:48:56Z")
Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a us… --- ## [Kibana 9.4.4 Security Update (ESA-2026-83)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534 "2026-08-13T10:48:53Z")
Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana featu… --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533 "2026-08-13T10:48:50Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Exce… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-129)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532 "2026-08-13T10:48:47Z")
Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys Description: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPE… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531 "2026-08-13T10:48:43Z")
Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts s… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530 "2026-08-13T10:48:40Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to … --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529 "2026-08-13T10:48:37Z")
Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to … --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-96)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-96/389528)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-96/389528 "2026-08-13T10:48:34Z")
Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on m… --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-95/389527)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-95/389527 "2026-08-13T10:48:31Z")
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed h… [Previous page](https://discuss.elastic.co/c/announcements/5.md?page=1) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=3)