CVE-2026-26936 MEDIUM

CVE-2026-26936: Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service

Vendor Elastic

Product Kibana

Weakness CWE-1333

Published February 26, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

4.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

Key dates

02Disclosure timeline

February 26, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-26936 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1333.html

Identifiers

CVE CVE-2026-26936

CWE CWE-1333

CVSS 4.9 / MEDIUM

Affected versions

Vendor Elastic

Product Kibana

Affected ≥ 9.0.0 and ≤ 9.2.4

Vendor Elastic

Product Kibana

Affected ≥ 8.0.0 and ≤ 8.19.10