by Kastro
Paper/Archive/CVE-2026-72676

CVE-2026-72676

Elastic Fleet Server — Improper Control of Generation of Code in Fleet Server Leading to Code Injection

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.9.459 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

Affected

ProductAffectedFixed inSource
Fleet Server8.5.0 – 8.19.19–CNA
Fleet Server9.0.0 – 9.4.4–CNA
Fleet Server9.5.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
elastic (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdiscuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510