# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160 "2026-09-03T18:01:52Z")
Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature c… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159 "2026-09-03T18:01:27Z")
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-140)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158 "2026-09-03T18:01:03Z")
Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege dec… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:37pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119 "2026-09-01T22:37:05Z")
Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorr… --- ## [Filebeat 8.19.18, 9.3.1 Security Update (ESA-2026-165)](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118 "2026-09-01T22:36:42Z")
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send s… --- ## [Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:36pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-16-9-3-5-9-4-2-security-update-esa-2026-164/390117 "2026-09-01T22:36:19Z")
Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege … --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-163)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-163/390116 "2026-09-01T22:35:56Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 9.4.4 Security Update (ESA-2026-161)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-161/390115 "2026-09-01T22:35:33Z")
Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Inf… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114 "2026-09-01T22:35:10Z")
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) … --- ## [Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-3-6-9-4-3-security-update-esa-2026-158/390113 "2026-09-01T22:34:47Z")
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in t… --- ## [Kibana 8.19.18, 9.4.3 Security Update (ESA-2026-157)](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-4-3-security-update-esa-2026-157/390112 "2026-09-01T22:34:24Z")
Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the … --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-156/390111 "2026-09-01T22:34:01Z")
Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via… --- ## [APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 "2026-09-01T22:33:38Z")
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excess… --- ## [Elastic Agent 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-150)](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109 "2026-09-01T22:33:15Z")
Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local p… --- ## [Elastic Maps Server 8.19.19, 9.4.4, 9.5.1 Security Update (ESA-2026-148)](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108 "2026-09-01T22:32:51Z")
Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elast… --- ## [Kibana 9.4.5 Security Update (ESA-2026-147)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107 "2026-09-01T22:32:28Z")
Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization co… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106 "2026-09-01T22:32:05Z")
Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privil… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105 "2026-09-01T22:31:42Z")
Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data vi… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-9-5-1-security-update-esa-2026-143/390094)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:47pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-9-5-1-security-update-esa-2026-143/390094 "2026-09-01T18:47:36Z")
Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). … --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-142)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:47pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093 "2026-09-01T18:47:09Z")
Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of dat… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-141)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092 "2026-09-01T18:46:43Z")
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsear… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-135/390091)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:46pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-135/390091 "2026-09-01T18:46:19Z")
Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege A… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090 "2026-09-01T18:45:54Z")
Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An… --- ## [Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-122/390089)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-122/390089 "2026-09-01T18:45:29Z")
Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrain… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:45pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088 "2026-09-01T18:45:04Z")
Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privil… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087 "2026-09-01T18:44:39Z")
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Objec… --- ## [Kibana 9.4.3 Security Update (ESA-2026-61)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-61/390086)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:44pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-61/390086 "2026-09-01T18:44:14Z")
Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-… --- ## [Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-5-security-update-esa-2026-48/390085)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:43pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-5-security-update-esa-2026-48/390085 "2026-09-01T18:43:48Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-3-0-security-update-esa-2026-47/390084)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:43pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-3-0-security-update-esa-2026-47/390084 "2026-09-01T18:43:23Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-168/390082)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-168/390082 "2026-09-01T18:41:59Z")
Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information dis… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=2)