# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=5 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 6 --- ## [Kibana 8.19.15, 9.3.4 Security Update (ESA-2026-49)](https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49/387444)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:59pm UTC](https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49/387444 "2026-07-01T13:59:08Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.13, 9.2.7, 9.3.2 Security Update (ESA-2026-46)](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46/387443)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:57pm UTC](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46/387443 "2026-07-01T13:57:44Z")
Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACL… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-45)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-45/387442)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:56pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-45/387442 "2026-07-01T13:56:52Z")
Improper Input Validation in Kibana Leading to Denial of Service Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a s… --- ## [Fleet Server 8.19.11, 9.2.5, 9.3.0 Security Update (ESA-2026-44)](https://discuss.elastic.co/t/fleet-server-8-19-11-9-2-5-9-3-0-security-update-esa-2026-44/387441)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:53pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-11-9-2-5-9-3-0-security-update-esa-2026-44/387441 "2026-07-01T13:53:44Z")
Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excess… --- ## [Elasticsearch 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-43)](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43/387440)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43/387440 "2026-07-01T13:51:51Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… --- ## [Elasticsearch 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-42)](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42/387439)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42/387439 "2026-07-01T13:50:07Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can subm… --- ## [Fleet Server 8.19.15, 9.3.4, 9.4.0 Security Update (ESA-2026-41)](https://discuss.elastic.co/t/fleet-server-8-19-15-9-3-4-9-4-0-security-update-esa-2026-41/387438)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:48pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-15-9-3-4-9-4-0-security-update-esa-2026-41/387438 "2026-07-01T13:48:04Z")
Dependency on Vulnerable Third-Party Component in Fleet Server Leading to Denial of Service Dependency on Vulnerable Third-Party Component (CWE-1395) exists in the Go standard library used by Fleet Server that could all… --- ## [Rally 2.13.0 released](https://discuss.elastic.co/t/rally-2-13-0-released/386697)
**Author:** [@Evgenia\_Badiyanova](https://discuss.elastic.co/u/Evgenia_Badiyanova)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 4:40pm UTC](https://discuss.elastic.co/t/rally-2-13-0-released/386697 "2026-06-03T16:40:19Z")
We have released Rally 2.13.0. This is a fairly big release with a few bug fixes and improvements. Some of the Highlights #2056: Add render-track command to render a track's Jinja2 templates to JSON #2047 / #2058: Add e… --- ## [Kibana 9.3.3 Security Update (ESA-2026-40)](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-40/386562)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-40/386562 "2026-05-28T19:26:45Z")
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the oper… --- ## [Kibana 8.19.16 Security Update (ESA-2026-39)](https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561 "2026-05-28T19:26:30Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user wi… --- ## [Kibana Fleet 8.19.16, 9.3.5, and 9.4.2 Security Update (ESA-2026-38)](https://discuss.elastic.co/t/kibana-fleet-8-19-16-9-3-5-and-9-4-2-security-update-esa-2026-38/386559)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-fleet-8-19-16-9-3-5-and-9-4-2-security-update-esa-2026-38/386559 "2026-05-28T19:26:13Z")
Improper Input Validation in Kibana Fleet Leading to Privilege Escalation Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user wi… --- ## [Kibana 9.2.8, and 9.3.2 Security Update (ESA-2026-37)](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557 "2026-05-28T19:25:55Z")
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-… --- ## [Kibana 8.19.16, and 9.3.5 Security Update (ESA-2026-36)](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 "2026-05-28T19:25:38Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-pri… --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-35)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-35/386554)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-35/386554 "2026-05-28T19:25:21Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user ca… --- ## [Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-34)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552 "2026-05-28T19:25:03Z")
Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A … --- ## [Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-33)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-33/386551)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-33/386551 "2026-05-28T19:24:46Z")
Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disc… --- ## [Kibana 8.19.16, 9.3.5, 9.4.1 Security Update (ESA-2026-32)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548 "2026-05-28T19:24:24Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user … --- ## [Kibana 8.19.16 and 9.3.5 Security Update (ESA-2026-30)](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545 "2026-05-28T19:24:06Z")
Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions cou… --- ## [🎉 What’s new in Elastic 9.4](https://discuss.elastic.co/t/what-s-new-in-elastic-9-4/386175)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [May 5, 2026, 4:31pm UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-4/386175 "2026-05-05T16:31:00Z")
:tada: What’s new in Elastic 9.4 Elastic 9.4 continues to reinforce the Elasticsearch Platform's role as the context and retrieval layer for AI workloads, while dramatically expanding its capabilities in metrics and t… --- ## [Elastic Package Registry 1.38.0 Security Update (ESA-2026-27)](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 28, 2026, 9:11pm UTC](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081 "2026-04-28T21:11:09Z")
Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an atta… --- ## [Upcoming geoip.elastic.co storage backend migration](https://discuss.elastic.co/t/upcoming-geoip-elastic-co-storage-backend-migration/385901)
**Author:** [@agunnerson-elastic](https://discuss.elastic.co/u/agunnerson-elastic)\ **Replies:** 1\ **Last updated:** [April 22, 2026, 4:15pm UTC](https://discuss.elastic.co/t/upcoming-geoip-elastic-co-storage-backend-migration/385901 "2026-04-22T16:15:23Z")
The Elastic GeoIP service (geoip.elastic.co) is the default endpoint from which Elasticsearch's GeoIP processor downloads the database used for looking up ASN/city/country data for an IP address. On 2026-04-22 at 16:00 U… --- ## [Logstash 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-29)](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:32pm UTC](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816 "2026-04-08T16:32:14Z")
Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write a… --- ## [Kibana 9.3.3 Security Update (ESA-2026-28)](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:29pm UTC](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815 "2026-04-08T16:29:23Z")
Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with wor… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-26)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814 "2026-04-08T16:25:26Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user wi… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-25)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:22pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813 "2026-04-08T16:22:12Z")
Incorrect Authorization in Kibana Fleet Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet age… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-24)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:18pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812 "2026-04-08T16:18:41Z")
Incorrect Authorization in Kibana Fleet Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privile… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-21)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811 "2026-04-08T16:01:33Z")
Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers ca… --- ## [Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)](https://discuss.elastic.co/t/elastic-otel-java-1-10-0-security-update-esa-2026-22-ghsa-xw7x-h9fj-p2c7/385700)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 30, 2026, 2:17pm UTC](https://discuss.elastic.co/t/elastic-otel-java-1-10-0-security-update-esa-2026-22-ghsa-xw7x-h9fj-p2c7/385700 "2026-03-30T14:17:53Z")
Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component (CWE-1395) exists in Elastic OTel Java via a dependency on OpenTelemetr… --- ## [Kibana 8.19.13, 9.2.7, 9.3.2 Security Update (ESA-2026-20)](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:59pm UTC](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535 "2026-03-19T16:59:58Z")
Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of S… --- ## [Elasticsearch 8.19.8, 9.1.8 Security Update (ESA-2026-18)](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-security-update-esa-2026-18/385534)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:59pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-security-update-esa-2026-18/385534 "2026-03-19T16:59:18Z")
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component (CWE-1395) exists in PyTorch used by the machine learning model loading component in Ela… [Previous page](https://discuss.elastic.co/c/announcements/5.md?page=4) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=6)