# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=4 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 5 --- ## [Kibana 9.4.4 Security Update (ESA-2026-70)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:34pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573 "2026-07-21T22:34:50Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied iden… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-69)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:28pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572 "2026-07-21T22:28:23Z")
Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification record… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-68)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:23pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571 "2026-07-21T22:23:26Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged a… --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569 "2026-07-21T22:06:14Z")
Missing Authorization in Kibana Leading to Unauthorized Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limit… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-66)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568 "2026-07-21T22:01:37Z")
Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to … --- ## [Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 9:06pm UTC](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566 "2026-07-21T21:06:08Z")
Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuratio… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-64)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565 "2026-07-21T21:01:02Z")
Reachable Assertion in Elasticsearch Leading to Denial of Service Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request … --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-63)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:32pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560 "2026-07-21T20:32:06Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-pri… --- ## [Elasticsearch 8.19.15, 9.2.9, 9.3.4 Security Update (ESA-2026-60)](https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:17pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559 "2026-07-21T20:17:24Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user wit… --- ## [Kibana 8.19.18, 9.3.7, 9.4.3 Security Update (ESA-2026-59)](https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:11pm UTC](https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558 "2026-07-21T20:11:35Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can… --- ## [Kibana 9.4.3 Security Update (ESA-2026-58)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-58/388557)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:06pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-58/388557 "2026-07-21T20:06:44Z")
Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist conf… --- ## [Elasticsearch 8.19.18, 9.3.7, 9.4.4 Security Update (ESA-2026-57)](https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 8:01pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556 "2026-07-21T20:01:46Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-priv… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-56)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-56/388555)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:44pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-56/388555 "2026-07-21T19:44:36Z")
Incorrect Authorization in Elasticsearch Leading to Information Disclosure Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authori… --- ## [Kibana 9.3.7, 9.4.4 Security Update (ESA-2026-55)](https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:31pm UTC](https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554 "2026-07-21T19:31:33Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 9.4.3 Security Update (ESA-2026-54)](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553 "2026-07-21T19:24:42Z")
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information e… --- ## [Kibana 7.17.15, 8.11.1 Security Update (ESA-2026-53)](https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53/387449)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:05pm UTC](https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53/387449 "2026-07-01T14:05:44Z")
Improper Output Neutralization for Logs in Kibana Leading to Log Injection Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacke… --- ## [Elasticsearch 7.17.24, 8.15.0 Security Update (ESA-2026-52)](https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52/387447)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52/387447 "2026-07-01T14:04:58Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authe… --- ## [Kibana 8.16.3, 8.17.2 Security Update (ESA-2026-51)](https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:03pm UTC](https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446 "2026-07-01T14:03:47Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Ac… --- ## [Kibana 8.18.9, 8.19.6, 9.0.8, 9.1.6 Security Update (ESA-2026-50)](https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50/387445)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 2:02pm UTC](https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50/387445 "2026-07-01T14:02:20Z")
Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional app… --- ## [Kibana 8.19.15, 9.3.4 Security Update (ESA-2026-49)](https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49/387444)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:59pm UTC](https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49/387444 "2026-07-01T13:59:08Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.13, 9.2.7, 9.3.2 Security Update (ESA-2026-46)](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46/387443)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:57pm UTC](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46/387443 "2026-07-01T13:57:44Z")
Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACL… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-45)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-45/387442)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:56pm UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-45/387442 "2026-07-01T13:56:52Z")
Improper Input Validation in Kibana Leading to Denial of Service Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a s… --- ## [Fleet Server 8.19.11, 9.2.5, 9.3.0 Security Update (ESA-2026-44)](https://discuss.elastic.co/t/fleet-server-8-19-11-9-2-5-9-3-0-security-update-esa-2026-44/387441)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:53pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-11-9-2-5-9-3-0-security-update-esa-2026-44/387441 "2026-07-01T13:53:44Z")
Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excess… --- ## [Elasticsearch 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-43)](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43/387440)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43/387440 "2026-07-01T13:51:51Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… --- ## [Elasticsearch 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-42)](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42/387439)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42/387439 "2026-07-01T13:50:07Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can subm… --- ## [Fleet Server 8.19.15, 9.3.4, 9.4.0 Security Update (ESA-2026-41)](https://discuss.elastic.co/t/fleet-server-8-19-15-9-3-4-9-4-0-security-update-esa-2026-41/387438)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [July 1, 2026, 1:48pm UTC](https://discuss.elastic.co/t/fleet-server-8-19-15-9-3-4-9-4-0-security-update-esa-2026-41/387438 "2026-07-01T13:48:04Z")
Dependency on Vulnerable Third-Party Component in Fleet Server Leading to Denial of Service Dependency on Vulnerable Third-Party Component (CWE-1395) exists in the Go standard library used by Fleet Server that could all… --- ## [Kibana 9.3.3 Security Update (ESA-2026-40)](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-40/386562)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-40/386562 "2026-05-28T19:26:45Z")
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the oper… --- ## [Kibana 8.19.16 Security Update (ESA-2026-39)](https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561 "2026-05-28T19:26:30Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user wi… --- ## [Kibana Fleet 8.19.16, 9.3.5, and 9.4.2 Security Update (ESA-2026-38)](https://discuss.elastic.co/t/kibana-fleet-8-19-16-9-3-5-and-9-4-2-security-update-esa-2026-38/386559)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:26pm UTC](https://discuss.elastic.co/t/kibana-fleet-8-19-16-9-3-5-and-9-4-2-security-update-esa-2026-38/386559 "2026-05-28T19:26:13Z")
Improper Input Validation in Kibana Fleet Leading to Privilege Escalation Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user wi… --- ## [Kibana 9.2.8, and 9.3.2 Security Update (ESA-2026-37)](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-9-2-8-and-9-3-2-security-update-esa-2026-37/386557 "2026-05-28T19:25:55Z")
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=3) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=5)