E

Elastic Security Announcements

https://discuss.elastic.co/c/announcements/security-announcements/31.rss (RSS订阅地址)

Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.2</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.3.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 4.9 ) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94408<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.3</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.4.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94397<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 9.4.7, 9.5.4 Security Update (ESA-2026-182)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>9.x: <ul> <li>All versions from 9.2.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.3</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 9.4.7, 9.5.4.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94396<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686">Read full topic</a></p>

2026/9/25
阅读更多

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-181)

<p><strong>Uncontrolled Resource Consumption in Kibana Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.2</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.3.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94400<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-180)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.3</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.4.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94399<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-179)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.12.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.3</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.4.</p> <p>The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the <a href="https://www.elastic.co/docs/release-notes">known issues</a> for your target version before upgrading.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-94398<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-176)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.7</li> <li>All versions from 9.5.0 up to and including 9.5.3</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations where authenticated users have privileges to invoke index analysis APIs.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 8.19.22, 9.4.7, 9.5.4.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-82300<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682">Read full topic</a></p>

2026/9/25
阅读更多

Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)

<p><strong>Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service</strong></p> <p>Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.20</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.5</li> <li>All versions from 9.5.0 up to and including 9.5.2</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> All configurations with analytical aggregation search capabilities enabled.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 8.19.21, 9.4.6, 9.5.3.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-82294<br> <strong>Problem Type:</strong> CWE-400 - Uncontrolled Resource Consumption<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681">Read full topic</a></p>

2026/9/25
阅读更多

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)

<p><strong>Missing Authorization in Kibana Leading to Unauthorized Deletion of Data</strong></p> <p>Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.</p> <p><strong>Affected Versions:</strong></p> <ul> <li>7.x: All versions 7.12.0 up to and including 7.17.29</li> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: <ul> <li>All versions from 9.0.0 up to and including 9.4.6</li> <li>All versions from 9.5.0 up to and including 9.5.2</li> </ul> </li> </ul> <p><strong>Affected Configurations:</strong><br> Deployments where Kibana spaces are in use and Synthetics monitors are shared across more than one space. Deployments where monitors are not shared across spaces are not exposed to this vulnerability.</p> <p><strong>Solutions and Mitigations:</strong><br> The issue is resolved in Kibana version 8.19.22, 9.4.7, 9.5.3.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong><br> No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N<br> <strong>CVE ID:</strong> CVE-2026-78582<br> <strong>Problem Type:</strong> CWE-862 - Missing Authorization<br> <strong>Impact:</strong> CAPEC-180 - Exploiting Incorrectly Configured Access Control Security Levels</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680">Read full topic</a></p>

2026/9/25
阅读更多

Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)

<p><strong>Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data</strong></p> <p>Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.</p> <p><strong>Affected Versions:</strong></p> <ul> <li>8.x: All versions from 8.0.0 up to and including 8.19.21</li> <li>9.x: All versions from 9.4.0 up to and including 9.4.5</li> </ul> <p><strong>Affected Configurations:</strong><br> Kibana deployments that use the Security Solution Timeline feature.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in Kibana version 8.19.22, 9.4.6.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p>There are no workarounds</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>A draft Timeline object whose creating user and last-updating user are distinct accounts indicates that a user other than the owner changed the object.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L<br> <strong>CVE ID:</strong> CVE-2026-72662<br> <strong>Problem Type:</strong> CWE-639 - Authorization Bypass Through User-Controlled Key<br> <strong>Impact:</strong> CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679">Read full topic</a></p>

2026/9/25
阅读更多

推荐订阅

Oracle Solaris Third Party Bulletins

Oracle Security Alerts

Oracle Linux Bulletins

Atlassian Security advisories

Siemens Security Advisories