CVE-2026-72676
Low
No strong exploitation signal.
CVSS base
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS — probability of exploitation (30 days)
0.4%
32.8th percentile
CISA KEV
Not listed
Weakness / dates
CWE-94
Published 2026-08-13 · modified 2026-09-04
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | H | High |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-08-13 — Published (NVD)
- 2026-09-04 — Last modified (NVD)
Description
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.