# Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72)

**URL:** <https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575>\
**Category:** Security Announcements\
**Created:** [July 21, 2026, 10:55pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575 "2026-07-21T22:55:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cronosda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cronosda/32/147882_2.png) [@cronosda](https://discuss.elastic.co/u/cronosda)\
**Post date:** [July 21, 2026, 10:55pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575/1 "2026-07-21T22:55:05Z")

</div>

**Uncontrolled Resource Consumption in Kibana Leading to Denial of Service**

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

**Affected Versions:**

- 8.x: All versions from 8.0.0 up to and including 8.19.18
- 9.x:
  - All versions from 9.0.0 up to and including 9.3.7
  - All versions from 9.4.0 up to and including 9.4.3

Users on the 9.5.x release line are not affected. Input validation improvements addressing this vulnerability were included in the 9.5.0 release before its initial publication.

**Affected Configurations:**

- All Kibana deployments with the machine learning feature enabled and accessible to authenticated users with low-privileged roles.

**Solutions and Mitigations:**

The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4.

**For Users that Cannot Upgrade:**

- **Self-Managed:** Setting xpack.ml.enabled to false in kibana.yml will disable the machine learning feature and prevent exploitation of this vulnerability. Note that this will remove all machine learning functionality from Kibana.

- **Cloud:** This configuration change is available via the Elasticsearch Service console's custom Kibana configuration. Note that disabling the machine learning feature removes all machine learning functionality.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H  
**CVE ID:** CVE-2026-63261  
**Problem Type:** CWE-400 - Uncontrolled Resource Consumption  
**Impact:** CAPEC-130 - Excessive Allocation