Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data

Cybersecuritynews •Abinaya • October 8, 2026

Elastic published 14 security advisories covering Elasticsearch, Kibana, and Elastic Agent/Endpoint, including a high-severity Kibana flaw that lets delegated Fleet users intercept data from other users or teams. Tracked as CVE-2026-102406, the Kibana flaw carries a CVSS score of 8.8. It affects Fleet’s package installation process, which failed to verify ownership before applying uploaded integration […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Elastic Addresses 14 Security Flaws, High-Severity Kibana Vulnerability Disclosed Elastic released 14 security advisories for vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint. A Kibana flaw, CVE-2026-102406, with a CVSS score of 8.8, allows attackers to intercept data from other users due to a package management oversight. This flaw affects versions 8.14.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3, with fixes available in 8.19.22, 9.4.7, and 9.5.4. Other vulnerabilities include CVE-2026-103009 (7.1), CVE-2026-102404 (6.5), CVE-2026-103008 (6.5), and CVE-2026-102413 (6.2), impacting various functionalities and potentially leading to denial-of-service conditions. Users are advised to upgrade their systems to mitigate these risks. 2 sources 61

Extracted Entities

Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (4)