Multiple vulnerabilities in Elastic products (September 25, 2026)

Risks - Compromise of data integrity - Compromise of data confidentiality - Circumvention of security policy - Remote denial of service - Privilege escalation Affected Systems - Elasticsearch versions 8.19.x prior to 8.19.22 - Elasticsearch versions 9.4.x prior to 9.4.7 - Elasticsearch versions 9.5.x prior to 9.5.4 - Kibana versions 9.5.x prior to 9.5.3 - Kibana versions 9.x prior to 9.4.7 - Kibana versions prior to 8.19.22 Summary Multiple vulnerabilities have been discovered in the Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service, and compromise of data confidentiality. Solutions Refer to the vendor's security bulletin for obtaining patches (see Documentation section). Documentation - Elastic Security Bulletin ESA-2026-103 of September 25, 2026 https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679 - Elastic Security Bulletin ESA-2026-139 of September 25, 2026 https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680 - Elastic Security Bulletin ESA-2026-170 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681 - Elastic Security Bulletin ESA-2026-176 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682 - Elastic Security Bulletin ESA-2026-179 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683 - Elastic Security Bulletin ESA-2026-180 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684 - Elastic Security Bulletin ESA-2026-181 of September 25, 2026 https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685 - Elastic Security Bulletin ESA-2026-182 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686 - Elastic Security Bulletin ESA-2026-183 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687 - Elastic Security Bulletin ESA-2026-184 of September 25, 2026 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688 - Elastic Security Bulletin ESA-2026-85 of September 25, 2026 https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678 - CVE Reference CVE-2026-72662 https://www.cve.org/CVERecord?id=CVE-2026-72662 - CVE Reference CVE-2026-72668 https://www.cve.org/CVERecord?id=CVE-2026-72668 - CVE Reference CVE-2026-78582 https://www.cve.org/CVERecord?id=CVE-2026-78582 - CVE Reference CVE-2026-82294 https://www.cve.org/CVERecord?id=CVE-2026-82294 - CVE Reference CVE-2026-82300 https://www.cve.org/CVERecord?id=CVE-2026-82300 - CVE Reference CVE-2026-94396 https://www.cve.org/CVERecord?id=CVE-2026-94396 - CVE Reference CVE-2026-94397 https://www.cve.org/CVERecord?id=CVE-2026-94397 - CVE Reference CVE-2026-94398 https://www.cve.org/CVERecord?id=CVE-2026-94398 - CVE Reference CVE-2026-94399 https://www.cve.org/CVERecord?id=CVE-2026-94399 - CVE Reference CVE-2026-94400 https://www.cve.org/CVERecord?id=CVE-2026-94400 - CVE Reference CVE-2026-94408 https://www.cve.org/CVERecord?id=CVE-2026-94408