CVE-2026-72676 is a medium severity (CVSS 6.5) code injection in Elastic Fleet Server, caused by Kibana accepting unsafe characters in an output configuration identifier. Elastic fixed it in versions 8.19.20, 9.4.5 and 9.5.1, and says there is no workaround, so upgrade Fleet Server and limit who can edit outputs.
What's affected
Elastic's announcement ESA-2026-93 lists these affected Fleet Server versions: all from 8.5.0 up to 8.19.19, all from 9.0.0 up to 9.4.4, and 9.5.0. All configurations are affected. The fixed versions are 8.19.20, 9.4.5 and 9.5.1.
Elastic states there are no workarounds and no known indicators of compromise. It also says Elastic Cloud Serverless was fixed before the announcement, so that offering needs no action.
The CVSS vector is AV:N/AC:L/PR:H/UI:N, which means the attacker needs high privileges. That is why the severity is medium even though the effect is code injection.
How to check if you're exposed
In Kibana, open Fleet and look at the Agents list. It shows the version of each agent, and the Fleet Server host shows its own version. Compare it with the fixed versions above.
Also review who holds privileges that can create or edit outputs and agent policies in Kibana, because that is the access the flaw needs.
What to do now
- Find your Fleet Server instances and their versions.
- Upgrade Fleet Server to 8.19.20, 9.4.5 or 9.5.1 or later, following Elastic's upgrade order for the stack.
- Review which users and API keys can edit Fleet outputs and agent policies, and reduce them to the people who need it.
- Review existing output configurations for identifiers that contain unusual characters.
- Read the Elastic announcement for any related Fleet and Kibana updates.
Why it matters
The record maps this to CWE-94, improper control of generation of code. Kibana accepted an identifier for an output without limiting it to safe characters. Fleet Server later placed that identifier into a script it builds as part of normal agent policy processing, so script syntax inside the identifier became part of the script that ran.
This is the same shape as many injection bugs. Data is mixed into code without being kept separate, so something that should be a label gets read as an instruction. The cure is to validate identifiers against a strict allowed set where they are accepted, and to pass them to scripts as parameters rather than pasting them into text.
The record's KEV flag is false.
Quick check
Is there a workaround for CVE-2026-72676?
Elastic says there are no workarounds. Upgrade, and limit who can edit Fleet outputs while you plan it.
Sources
Last reviewed: 19 October 2026.
