BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-72676Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

9.1 CRITICALEPSS 0.54%Not in KEVNVD: Analyzed

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.1CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
6.5MEDIUM3.1elastic (CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Details

CVE ID
CVE-2026-72676
Status
Analyzed
Assigner (CNA)
elastic
Published
Aug 13, 2026
Last modified
2026-09-04 20:21 UTC
Weaknesses
  • CWE-94 · Improper Control of Generation of Code ('Code Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:59 UTC.