PT-2025-40966 · Elastic · Kibana

Published 2025-10-07 · Updated 2026-03-25 · CVE-2025-25017

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions 5.3 through 8.7

Description Several cross-site scripting (XSS) issues have been disclosed by Elastic in Kibana. These issues could potentially allow for malicious code execution within the application. A search on Netlas.io using the dork 'http.unknown headers.key:"kbn name"' may identify potentially affected instances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ELK-2025-25017

BIT-KIBANA-2025-25017

CVE-2025-25017

Affected Products

Kibana

References · 15

• https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25017 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elk-2025-25017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25017 · Security Note
• https://osv.dev/vulnerability/BIT-kibana-2025-25017 · Vendor Advisory
• https://twitter.com/cracbot/status/1978415602009252073 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1976597518327722106 · Twitter Post
• https://t.me/cveNotify/138120 · Telegram Post
• https://twitter.com/vicariusltd/status/2036895938393104476 · Twitter Post
• https://t.me/CVEtracker/34559 · Telegram Post
• https://twitter.com/autumn_good_35/status/1975933219196514753 · Twitter Post
• https://t.me/netlas/487 · Telegram Post
• https://twitter.com/Netlas_io/status/1975434353355235624 · Twitter Post
• https://twitter.com/CveTodo/status/1976595615850062225 · Twitter Post
• https://twitter.com/CVEnew/status/1976592784531612042 · Twitter Post