# CVE-2019-7609: Kibana Arbitrary Code Execution

Source: https://junglewise.ai/threats/cve-2019-7609-kibana-arbitrary-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-7609 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2022-01-10

Kibana contains an arbitrary code execution vulnerability in the Timelion visualizer. An attacker can send a crafted request to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2019-7609 exploited in the wild?** Yes. CVE-2019-7609 is known to be exploited in the wild, first recorded on 10 January 2022. Treat it as urgent.

**How severe is CVE-2019-7609?** Critical severity, with a CVSS score of 10, published 10 January 2022.

**Which products and versions are affected?** Elastic Kibana before 5.6.15, and 6.0.0 to 6.6.1; Red Hat Openshift Container Platform 3.11, 4.1.

**Is there a fix for CVE-2019-7609?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-7609 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-7609?** Check whether you run Elastic Kibana. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Elastic Kibana before 5.6.15, and 6.0.0 to 6.6.1
- Red Hat Openshift Container Platform 3.11, 4.1

## Timeline

- 2019-02-19: advisory: Elastic security update for 6.6.1 and 5.6.15 published
- 2019-03-26: disclosed: Initial NVD analysis published
- 2022-01-10: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-01-10: exploited: Reported as exploited in the wild

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana incorrect authorization in Fleet settings](https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive)