CVE-2026-94400: 
Kibana vulnerability analysis and mitigation

CVE-2026-94400 is an Uncontrolled Resource Consumption (CWE-400) vulnerability in Elastic Kibana that can lead to denial of service via excessive allocation (CAPEC-130). It affects Kibana versions 8.0.0 through 8.19.21, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.2. The vulnerability was published on September 26, 2026, with patches released in versions 8.19.22, 9.4.7, and 9.5.3. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Elastic Advisory).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and is exploitable via the network with low attack complexity. An authenticated attacker with low privileges can send crafted requests that trigger excessive resource allocation within Kibana, exhausting system resources without requiring user interaction. The attack pattern aligns with CAPEC-130 (Excessive Allocation) and related patterns such as CAPEC-492 (Regular Expression Exponential Blowup) and CAPEC-147 (XML Ping of the Death), suggesting the root cause may involve unbounded processing of attacker-controlled input (GitHub Advisory, Elastic Advisory).

Successful exploitation results in a denial of service, rendering the Kibana instance unavailable to legitimate users. The vulnerability has no impact on confidentiality or data integrity — only availability is affected (rated High). Any authenticated user with network access to Kibana can exhaust the service's resources, potentially disrupting security monitoring, log analysis, and operational dashboards that depend on Kibana (GitHub Advisory, Elastic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC assessment (exploitation: none) and Feedly threat intelligence data. The EPSS score is approximately 0.41–0.42%, placing it in the 34th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Qualys (ID: 520324) and Nessus (plugin ID: 351859) (GitHub Advisory, Tenable).

Elastic has released patched versions addressing this vulnerability: 8.19.22 (for the 8.x branch), 9.4.7 (for the 9.4.x branch), and 9.5.3 (for the 9.5.x branch). Organizations unable to patch immediately should apply network-level access controls to restrict which authenticated users can reach the Kibana interface, reducing the attack surface. Upgrading to a patched version is the recommended long-term remediation (Elastic Advisory, GitHub Advisory).

Media coverage noted that Elastic patched multiple security flaws across Elasticsearch and Kibana in this release cycle, including higher-severity privilege escalation bugs, with CVE-2026-94400 being one of several addressed issues (Undercode News, CyberPress). No notable individual researcher commentary or significant social media discussion specific to this CVE has been observed.