# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=4 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 5 --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-75)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-75/389496)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-75/389496 "2026-08-13T10:46:50Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request tha… --- ## [Elasticsearch 8.18.0, 9.0.0 Security Update (ESA-2026-111)](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495 "2026-08-13T10:46:46Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of servic… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494 "2026-08-13T10:46:43Z")
Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493 "2026-08-13T10:46:40Z")
Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in E… --- ## [Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:39am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492 "2026-08-13T10:39:59Z")
Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case … --- ## [🎉 What’s new in Elastic 9.5](https://discuss.elastic.co/t/what-s-new-in-elastic-9-5/388970)
**Author:** [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Replies:** 0\ **Last updated:** [August 4, 2026, 3:53pm UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-5/388970 "2026-08-04T15:53:13Z")
:tada: What’s new in Elastic 9.5 Elastic 9.5 promotes native PromQL, Dashboards API, Cases as Data, and natural language authoring to general availability. 9.5 also introduces Columnar Mode, VectorDB index mode, a new… --- ## [9.4.4 tag but no 9.4.4 release](https://discuss.elastic.co/t/9-4-4-tag-but-no-9-4-4-release/388655)
**Author:** [@Michka](https://discuss.elastic.co/u/Michka)\ **Replies:** 3\ **Last updated:** [July 23, 2026, 8:42pm UTC](https://discuss.elastic.co/t/9-4-4-tag-but-no-9-4-4-release/388655 "2026-07-23T20:42:08Z")
Hello Homebrew maintainer here. We noticed that there is no 9.4.4 release on Github, but a 9.4.4 tag. Is this expected? In general the latest tag is also marked as official release for Elastic, so we want to make sure … --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-74)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577 "2026-07-21T23:08:36Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An a… --- ## [Kibana 9.4.4 Security Update (ESA-2026-73)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 11:05pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576 "2026-07-21T23:05:08Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-leve… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:55pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575 "2026-07-21T22:55:05Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authent… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-71)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:51pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574 "2026-07-21T22:51:22Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacke… --- ## [Kibana 9.4.4 Security Update (ESA-2026-70)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573 "2026-07-21T22:34:50Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied iden… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-69)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:28pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572 "2026-07-21T22:28:23Z")
Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification record… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-68)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:23pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571 "2026-07-21T22:23:26Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged a… --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569 "2026-07-21T22:06:14Z")
Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limit… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-66)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568 "2026-07-21T22:01:37Z")
Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to … --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 9:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566 "2026-07-21T21:06:08Z")
Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuratio… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-64)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565 "2026-07-21T21:01:02Z")
Reachable Assertion in Elasticsearch Leading to Denial of Service Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request … --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-63)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:32pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560 "2026-07-21T20:32:06Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-pri… --- ## [Elasticsearch 8.19.15, 9.2.9, 9.3.4 Security Update (ESA-2026-60)](https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:17pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559 "2026-07-21T20:17:24Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user wit… --- ## [Kibana 8.19.18, 9.3.7, 9.4.3 Security Update (ESA-2026-59)](https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:11pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558 "2026-07-21T20:11:35Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can… --- ## [Kibana 9.4.3 Security Update (ESA-2026-58)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-58/388557)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:06pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-58/388557 "2026-07-21T20:06:44Z")
Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist conf… --- ## [Elasticsearch 8.19.18, 9.3.7, 9.4.4 Security Update (ESA-2026-57)](https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:01pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556 "2026-07-21T20:01:46Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-priv… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-56)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-56/388555)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-56/388555 "2026-07-21T19:44:36Z")
Incorrect Authorization in Elasticsearch Leading to Information Disclosure Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authori… --- ## [Kibana 9.3.7, 9.4.4 Security Update (ESA-2026-55)](https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:31pm UTC](https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554 "2026-07-21T19:31:33Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 9.4.3 Security Update (ESA-2026-54)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553 "2026-07-21T19:24:42Z")
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information e… --- ## [Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53)](https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53/387449)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:05pm UTC](https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53/387449 "2026-07-01T14:05:44Z")
Improper Output Neutralization for Logs in Kibana Leading to Log Injection Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacke… --- ## [Elasticsearch 7.17.24, 8.15.0 Security Update (ESA-2026-52)](https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52/387447)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52/387447 "2026-07-01T14:04:58Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authe… --- ## [Kibana 8.16.3, 8.17.2 Security Update (ESA-2026-51)](https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:03pm UTC](https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446 "2026-07-01T14:03:47Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Ac… --- ## [Kibana 8.18.9, 8.19.6, 9.0.8, 9.1.6 Security Update (ESA-2026-50)](https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50/387445)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:02pm UTC](https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50/387445 "2026-07-01T14:02:20Z")
Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional app… [Previous page](https://discuss.elastic.co/c/announcements/5.md?page=3) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=5)