Kibana 9.4.6/9.5.2 Security Update (ESA-2026-130): CWE-863 Authz Flaw (CVE-2026-7263)

Kibana 9.4.6 and 9.5.2 Security Update (ESA-2026-130) Vulnerability Overview Vulnerability Name: Inadequate authorization in Kibana causes permission monitoring to be disabled without authorization CVE ID: CVE-2026-7263 Issue Type: CWE-863 - Inadequate Authorization Severity: CVSS 3.1 Medium (4.3) Impact: CAPEC-1 - Insufficiently constrained access to features Description: The Entity Analytics permission monitoring feature in Kibana contains an authorization flaw (CWE-863), which can lead to insufficiently constrained access to features (CAPEC-1), resulting in the failure of security monitoring. An authenticated user with only read-only permissions can stop the permission monitoring engine task in the Kibana namespace, causing the namespace to stop generating data, while the engine continues to report a healthy status to operators. Scope of Impact Affected Versions: - 9.x: All versions from 9.1.0 through 9.4.5 - All versions from 9.5.0 through 9.5.1 Not Affected: Versions prior to 9.1.0 (including all 8.x versions), as the affected feature does not exist Affected Configurations: - Kibana deployments running an affected version with the Entity Analytics permission monitoring engine initialized - Exploitation conditions: Authenticated users with read-only permissions + no Elasticsearch feature access + no Elasticsearch feature access - Requires non-privileged permissions - Both self-managed and Elastic Cloud managed deployments are affected; this is not a default configuration Remediation Solution: The issue has been fixed in Kibana 9.4.6 and 9.5.2 Users Unable to Upgrade: There are no workarounds available for this vulnerability Indicators of Compromise (IOC): No indicators of compromise have been identified Elastic Cloud Serverless: Due to its continuous deployment and patching model, this vulnerability has been mitigated in Elastic Cloud Serverless, prior to public disclosure

Goal Reached Thanks to every supporter — we hit 100%!

Kibana 9.4.6/9.5.2 Security Update (ESA-2026-130): CWE-863 Authz Flaw (CVE-2026-7263)