CVE-2026-72676
published 2026-08-13CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code…
PriorityP359critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.55%
45.1th percentile
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | fleet_server | — | — |
| elastic | fleet_server | 8.5.0 – 8.19.19 | — |
| elastic | fleet_server | 9.0.0 – 9.4.4 | — |
| elastic | kibana | — | — |
| elastic | kibana | >= 8.5.0 < 8.19.20 | 8.19.20 |
| elastic | kibana | >= 9.0.0 < 9.4.5 | 9.4.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Fleet Server prior 8.19.20/9.4.5/9.5.1 Agent Policy Processing code injection (EUVD-2026-58263)
vuldb·2026-08-13·CVSS 6.5
CVE-2026-72676 [MEDIUM] Elastic Fleet Server prior 8.19.20/9.4.5/9.5.1 Agent Policy Processing code injection (EUVD-2026-58263)
A vulnerability described as problematic has been identified in Elastic Fleet Server. Impacted is an unknown function of the component Agent Policy Processing. The manipulation results in code injection.
This vulnerability is identified as CVE-2026-72676. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242).
ghsa_unreviewed·2026-08-13
CVE-2026-72676 [MEDIUM] CWE-94 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242).
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published