# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077 "2026-09-01T18:41:43Z")
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in K… --- ## [Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072 "2026-09-01T18:41:27Z")
Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functio… --- ## [Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069 "2026-09-01T18:41:12Z")
Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access C… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064 "2026-09-01T18:40:51Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to… --- ## [Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059 "2026-09-01T18:40:35Z")
Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functional… --- ## [Kibana 9.4.6 Security Update (ESA-2026-84)](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054 "2026-09-01T18:40:17Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.17, 9.3.0 Security Update (ESA-2026-31)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-0-security-update-esa-2026-31/390050)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-0-security-update-esa-2026-31/390050 "2026-09-01T18:40:01Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Winlogbeat 8.13.0 Security Update (ESA-2024-49)](https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044 "2026-09-01T13:42:24Z")
Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be pla… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539 "2026-08-13T10:49:09Z")
Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation… --- ## [Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538 "2026-08-13T10:49:06Z")
Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one … --- ## [Kibana 9.4.5 Security Update (ESA-2026-97)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:49am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537 "2026-08-13T10:49:03Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query exe… --- ## [Kibana 9.4.5 Security Update (ESA-2026-89)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536 "2026-08-13T10:48:59Z")
Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries El… --- ## [Kibana 9.4.5 Security Update (ESA-2026-82)](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535 "2026-08-13T10:48:56Z")
Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a us… --- ## [Kibana 9.4.4 Security Update (ESA-2026-83)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534 "2026-08-13T10:48:53Z")
Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana featu… --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533 "2026-08-13T10:48:50Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Exce… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-129)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532 "2026-08-13T10:48:47Z")
Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys Description: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPE… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531 "2026-08-13T10:48:43Z")
Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts s… --- ## [Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530 "2026-08-13T10:48:40Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to … --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529 "2026-08-13T10:48:37Z")
Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to … --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-96)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-96/389528)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-96/389528 "2026-08-13T10:48:34Z")
Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on m… --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-95/389527)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-95/389527 "2026-08-13T10:48:31Z")
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed h… --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526 "2026-08-13T10:48:28Z")
Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization (CWE-862) in Kibana can lead to cross-space informati… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525 "2026-08-13T10:48:24Z")
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts ma… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524 "2026-08-13T10:48:21Z")
Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire confi… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523 "2026-08-13T10:48:18Z")
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-106)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-106/389522)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-106/389522 "2026-08-13T10:48:15Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-105)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521 "2026-08-13T10:48:11Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Function… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-104)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520 "2026-08-13T10:48:08Z")
Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Description: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A spe… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-100)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519 "2026-08-13T10:48:05Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excess… --- ## [Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-4-security-update-esa-2026-90/389518)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-4-security-update-esa-2026-90/389518 "2026-08-13T10:48:02Z")
Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locati… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=1) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=3)