THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-72676 (MEDIUM 6.5) — Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. Th

[NVD] CVE-2026-72676 (MEDIUM 6.5) — Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. Th

mednvdPublished 2026-08-13

CVE-2026-72676 CVSS: 6.5 MEDIUM Published: 2026-08-13T20:17:28.257

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side scr

Indicators of compromise

CVE-2026-72676cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72676