CVE-2026-72664
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Kibana has a missing authorization vulnerability (CWE-862) allowing unauthorized execution of Elastic Defend response actions on managed hosts. A user with only detection rule authoring privileges can associate automated endpoint response actions with a rule, even without dedicated endpoint privileges. When the rule generates alerts, the actions are executed on matching hosts.
Risk Assessment
The attack can lead to unauthorized actions on hosts, such as host isolation or process operations, potentially disrupting systems or compromising security.
Recommendation
Update Kibana to the patched version. Adjust roles so users without endpoint action privileges cannot assign them to rules.
Original NVD description (English source)
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts.