CVE-2026-72676

CriticalCVSS 9.1/10Last modified Sep 4, 2026

Description

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-726777.3Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139)CVE-2026-726786.5Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal da CVE-2026-726796.5Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling CVE-2026-72686.3A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/aj CVE-2026-726805.4Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership CVE-2026-726818.8Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it CVE-2026-726826.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-726836.5A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.CVE-2026-726846.5A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user CVE-2026-726854.3A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a cr CVE-2026-726866.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A sp CVE-2026-726876.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. E