# Do I need to upgrade?. Kibana 8.17.3 Security Update (ESA-2025-06)

**URL:** <https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-security, elastic-stack-alerting\
**Created:** [March 12, 2025, 4:21am UTC](https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756 "2025-03-12T04:21:36Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Nghia\_D\_ng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nghia_d_ng/32/123483_2.png) [@Nghia\_D\_ng](https://discuss.elastic.co/u/Nghia_D_ng)\
**Post date:** [March 12, 2025, 5:58am UTC](https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756/2 "2025-03-12T05:58:53Z")

</div>

> [@Kibana 8.17.3 / 8.16.6 Security Update (ESA-2025-06)](https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441):
>
> Kibana arbitrary code execution via prototype pollution (ESA-2025-06) Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions \>= 8.15.0 and \< 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors This is…

---

_[View the full topic](https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756)._