Is CVE-2026-78591 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78591 being exploited in the wild.

How severe is CVE-2026-78591?

Medium severity, with a CVSS score of 6.3, published 2 September 2026.

Which products and versions are affected?

Elastic Kibana 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2.

Is there a fix for CVE-2026-78591?

A patch was published on 2026-09-02: Fixed in Kibana 8.19.17, 9.3.6, and 9.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78591 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78591?

Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78591: Elastic Kibana path traversal in Fleet feature

CVE-2026-78591 · Severity: medium · CVSS 6.3 · Published 2026-09-02

Kibana, Elastic's data visualization and administration tool, contains a path traversal vulnerability in its Fleet feature that allows low-privileged users to manipulate file paths. An attacker could trick a higher-privileged administrator into deleting unintended resources, including accounts with elevated permissions, by crafting malicious path inputs that bypass directory restrictions. This could lead to unauthorized account deletion and disruption of critical administrative functions.

Technologies: Elastic Kibana. Vendors: Elastic.

Quick answers

Is CVE-2026-78591 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78591 being exploited in the wild.
How severe is CVE-2026-78591?: Medium severity, with a CVSS score of 6.3, published 2 September 2026.
Which products and versions are affected?: Elastic Kibana 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2.
Is there a fix for CVE-2026-78591?: A patch was published on 2026-09-02: Fixed in Kibana 8.19.17, 9.3.6, and 9.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78591 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78591?: Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-22) in Kibana's Fleet administration feature that fails to properly restrict pathname inputs. An attacker with low privileges can craft a malicious path that exploits this validation weakness, causing a subsequent action by a higher-privileged user (requiring user interaction via the Fleet admin interface) to operate on an unintended target directory or resource. The vulnerability enables unauthorized deletion of arbitrary resources, including high-privilege user accounts. Attack vector is network-based with low privilege requirement and requires user interaction (UI:R). Patches are available in Kibana 8.19.17, 9.3.6, and 9.4.3; no workarounds exist for affected deployments with Fleet enabled.

Affected products

Elastic Kibana 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2

Timeline

2026-09-02: disclosed: CVE-2026-78591 disclosed publicly
2026-09-02: patched: Fixed in Kibana 8.19.17, 9.3.6, and 9.4.3

References

https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.