Cyber Posture

CVE-2026-26937

Medium

Published: 26 February 2026

Published
26 February 2026
Modified
02 March 2026
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0006 20.1th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26937 is a medium-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Elastic Kibana. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application Exhaustion Flood (T1499.003).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-400

Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.

addresses: CWE-400

Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts.

addresses: CWE-400

Contingency plan testing includes resource exhaustion scenarios to verify recovery, making it harder for attackers to sustain exploits that cause uncontrolled consumption.

addresses: CWE-400

Updated contingency plans include current procedures to detect, contain, and recover from resource exhaustion, limiting an attacker's ability to sustain impact from uncontrolled consumption.

addresses: CWE-400

Alternate site allows resumption of operations if resource exhaustion at the primary site is exploited to cause unavailability.

addresses: CWE-400

Alternate telecommunications services enable resumption of essential functions when primary services become unavailable due to uncontrolled resource consumption.

addresses: CWE-400

The team can analyze and respond to resource exhaustion incidents, reducing the impact of attacks that exploit uncontrolled consumption weaknesses.

addresses: CWE-400

Timely maintenance support and spare parts enable rapid recovery from failures induced by uncontrolled resource consumption, shortening the impact window of denial-of-service attacks.

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Why these techniques?

Uncontrolled resource consumption (CWE-400) via crafted input in Kibana Timelion directly enables application-layer resource exhaustion DoS by an authenticated network attacker.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

Deeper analysisAI

CVE-2026-26937 is an uncontrolled resource consumption vulnerability (CWE-400) affecting the Timelion component in Kibana. Published on 2026-02-26, it enables denial of service through input data manipulation (CAPEC-153). The issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

An attacker requires low privileges to exploit this vulnerability over the network with low attack complexity and no user interaction. Successful exploitation results in high-impact denial of service via resource exhaustion, with no effects on confidentiality or integrity.

Elastic's security advisory ESA-2026-15, available at https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-15/385251, addresses the vulnerability with updates for Kibana versions including 8.19.1 and 9.2.5.

Details

CWE(s)

Affected Products

elastic
kibana
8.0.0 — 8.19.11 · 9.0.0 — 9.2.5

CVEs Like This One

CVE-2026-26935Same product: Elastic Kibana
CVE-2026-33458Same product: Elastic Kibana
CVE-2026-33461Same product: Elastic Kibana
CVE-2024-43707Same product: Elastic Kibana
CVE-2026-4498Same product: Elastic Kibana
CVE-2026-26938Same product: Elastic Kibana
CVE-2025-25015Same product: Elastic Kibana
CVE-2026-0528Same product: Elastic Kibana
CVE-2026-26936Same product: Elastic Kibana
CVE-2026-36958Shared CWE-400

References