# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) --- ## [About the Security Announcements category](https://discuss.elastic.co/t/about-the-security-announcements-category/2060)
**Author:** [@Leslie\_Hawthorn](https://discuss.elastic.co/u/Leslie_Hawthorn)\ **Replies:** 0\ **Last updated:** [June 6, 2015, 11:59am UTC](https://discuss.elastic.co/t/about-the-security-announcements-category/2060 "2015-06-06T11:59:59Z")
Security announcements for the Elastic stack. To report a security vulnerability, please follow the instructions on our Security Issues page. Posting to this category is restricted to staff only. --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688 "2026-09-25T08:35:53Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687 "2026-09-25T08:35:28Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 9.4.7, 9.5.4 Security Update (ESA-2026-182)](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686 "2026-09-25T08:35:05Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-181)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:34am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685 "2026-09-25T08:34:42Z")
Uncontrolled Resource Consumption in Kibana Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: A… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-180)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684 "2026-09-25T08:34:19Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-179)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683 "2026-09-25T08:33:56Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-176)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682 "2026-09-25T08:33:33Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected … --- ## [Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681 "2026-09-25T08:33:09Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected … --- ## [Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680 "2026-09-25T08:32:46Z")
Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security … --- ## [Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679 "2026-09-25T08:32:22Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthor… --- ## [Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:31am UTC](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678 "2026-09-25T08:31:59Z")
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A n… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164 "2026-09-03T18:03:25Z")
Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured … --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163 "2026-09-03T18:03:02Z")
Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CA… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162 "2026-09-03T18:02:39Z")
Incorrect Authorization in Kibana Leading to Denial of Service Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). … --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161 "2026-09-03T18:02:15Z")
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to u… --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160 "2026-09-03T18:01:52Z")
Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature c… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159 "2026-09-03T18:01:27Z")
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-140)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158 "2026-09-03T18:01:03Z")
Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege dec… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:37pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119 "2026-09-01T22:37:05Z")
Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorr… --- ## [Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118 "2026-09-01T22:36:42Z")
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send s… --- ## [Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117 "2026-09-01T22:36:19Z")
Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege … --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-163)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116 "2026-09-01T22:35:56Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 9.4.4 Security Update (ESA-2026-161)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115 "2026-09-01T22:35:33Z")
Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Inf… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114 "2026-09-01T22:35:10Z")
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) … --- ## [Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113 "2026-09-01T22:34:47Z")
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in t… --- ## [Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112 "2026-09-01T22:34:24Z")
Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the … --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111 "2026-09-01T22:34:01Z")
Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via… --- ## [APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 "2026-09-01T22:33:38Z")
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excess… --- ## [Elastic Agent 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-150)](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109 "2026-09-01T22:33:15Z")
Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local p… [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=1)