PT-2026-26325 · Elastic · Kibana

Ismisepaul + 1 · CVE-2026-26940 · Published 2026-03-19 · Updated 2026-03-23

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An improper validation of the quantity specified in input within the Timelion visualization plugin can lead to a denial of service through excessive allocation. An authenticated user can send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value. This issue is related to CAPEC-130 and CWE-1284.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2026-26940

Affected Products

Kibana

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26940.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26940 · Security Note
• https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26940 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034734057590837338 · Twitter Post
• https://twitter.com/CVEnew/status/2036024191716392971 · Twitter Post