CVE-2026-72660

The CVSS 6.5 and EPSS 0.00359 on this CVE create a false sense of manageable risk. Don't let the numbers fool you — a low-privileged user can repeatedly crash Kibana for your entire organization, and the downstream impact goes far beyond a dashboard being unavailable. This is a privilege-severity inversion. Traditionally, lower-privileged accounts mean narrower blast radius if compromised. Here, the attacker doesn't need to escalate privileges to cause maximum operational damage — they just need to supply malformed data on a specific execution path. The uncaught exception propagating to process termination means no defensive programming caught it, no graceful degradation occurred. This code path was never designed with adversarial input in mind. The 'repeatable' aspect is critical. This isn't an edge case that crashes once under specific conditions — it's a reliable, repeatable DoS vector. In a multi-tenant or shared-service environment, one low-privileged actor can conduct a form of service-level extortion without technical skill. What makes this dangerous beyond its CVSS rating: Kibana is almost certainly your primary interface into Elasticsearch, which is ingesting logs from your security tooling, SIEM pipeline, application monitoring, and compliance logging. When that uncaught exception terminates Kibana, you're not just losing a visualization dashboard — you're losing the operational visibility your incident responders use during an active breach. You're blinding your SOC precisely when they need eyes on. CVSS measures process restart time; it doesn't model 'the security team can't see what's happening.' The architectural question is whether this is isolated or systemic. Check whether your Kibana deployment has rate limiting, per-user resource quotas, or execution sandboxing that would constrain repeatability. But understand these are constraints on expression, not closure — they don't fix the underlying vulnerability. The deeper question is which other execution paths in Kibana predate the current threat model and were never retrofitted as permissions tightened. Within 18 months, expect another similar uncaught exception in a different input path — the patch will likely be surgical rather than systemic. Treat this as a cascade risk in your threat model, not a CVSS metric. The attacker with low privileges isn't just holding a kill switch — they're holding a kill switch over everyone else's situational awareness.

Reviewed through automated stages and approved by a human before publication.