Elastic has released security updates for multiple vulnerabilities in Elasticsearch and Kibana, the most significant of which is the Elasticsearch DoS threat through uncontrolled resource consumption. The vulnerabilities allow users with network privileges to cause severe degradation or outages.
Elastic 's related announcements concern CVE-2026-94408 and CVE-2026-94397 in Elasticsearch, as well as CVE-2026-94400 in Kibana. All three cases are classified as CWE-400, meaning uncontrolled resource consumption that can lead to a denial of service.
See also: Vulnerability in Elastic Cloud Enterprise allows execution of malicious commands
What does Elasticsearch DoS risk mean?
CVE-2026-94408 has a CVSS score of 4.9 and affects all versions of Elasticsearch from 8.0.0 through 8.19.21, as well as certain versions of the 9.x branches. The exploit is network-based, requires elevated privileges, and requires no user interaction, with the primary outcome being loss of availability.
CVE-2026-94397 is more severe, with a CVSS of 6.5, because it only requires low privileges. An authenticated user could cause excessive resource allocation and affect system responsiveness. The NVD listing confirms that the issue affects versions 8.0.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3.
In practical terms, an Elasticsearch DoS can manifest as a gradual increase in latency, failed lookups, or node reboots. The picture doesn't necessarily resemble a classic external flood of requests, which is why correlating logs with memory and CPU usage is critical.
The attack does not target data confidentiality or integrity. The problem lies in the management of memory and computing resources, so a malicious or compromised account could create exhaustion conditions. In environments with many nodes, the load can affect searches, dashboards, and applications that depend on the Elastic Stack.
Kibana is affected by a similar bug
CVE-2026-94400 extends the image to Kibana and has a CVSS of 6.5. The vulnerability can be exploited remotely with low complexity and low privileges, without user interaction. Uncontrolled resource allocation can lead to service interruption, affecting data visibility and monitoring functions.
The Kibana security update targets versions 8.19.22, 9.4.7, and 9.5.3. Elastic says that all configurations are considered affected and does not provide a workaround for installations that cannot be upgraded immediately.
Although Kibana acts as a visualization and management layer, an Elasticsearch DoS can also be felt by applications that use Elastic Stack data. Loss of availability in dashboards makes it difficult to both monitor an incident and operate.
The common pattern of the three CVEs shows why administrators should not limit themselves to monitoring public interfaces. Low- or high-privilege access, when combined with an exposed Kibana or Elasticsearch, is enough to turn an account into a service disruption. Monitoring memory and response time spikes can serve as an early indicator.
See also: Vulnerability in Kibana Crowdstrike Connector exposes protected credentials
What are the necessary protective measures?
Elastic recommends upgrading to Elasticsearch versions 8.19.22, 9.4.7, or 9.5.3 for CVE-2026-94408, and to 8.19.22, 9.4.7, or 9.5.4 for CVE-2026-94397. For Kibana, fixes are included in 8.19.22, 9.4.7, and 9.5.3. Organizations should review the known incompatibilities of each version before making the change.
The releases listed by Elastic are the first to have the fix built in, while later releases also include the patches. For Elastic Cloud Serverless installations, the company says the remediation was completed before the public disclosure. This does not exempt self-managed nodes from scrutiny.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Until the upgrade is complete, the SecNews technical team recommends restricting access to management interfaces, reviewing user roles, and avoiding exposing Kibana to the internet without additional control. At the same time, it is necessary to record memory usage, failed requests, and unusual increases in node load.
Operations teams can also test upgrades on a separate node, confirm add-on compatibility, and back up configurations. Proactive preparation reduces recovery time in the event availability is impacted before the maintenance window is complete.
The incident is a reminder that an Elasticsearch DoS does not always require unauthenticated access or sophisticated exploit code. An account with limited privileges and an out-of-date installation are enough to increase operational risk. Timely application of updates and restriction of privileges remain the most immediate measures against new vulnerabilities.
See also: Elastic EDR: Zero-day allows malware execution and BSOD
