Important: Elastic Stack security update
Type/Severity
NetEye Product Security has rated this update as having a High security impact.
Topic
Updates for the Elastic Stack packages are now available for NetEye 4.
Security Fix for NetEye 4.49
9.4.6_neteye3.103.8-1
CVEs
Elastic Agent
- CVE-2026-78604
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Kibana
- CVE-2026-78608
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVE-2026-72654
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVE-2026-72628
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-72682
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-72641
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - CVE-2026-78603
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-82293
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVE-2026-78597
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-72633
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVE-2026-78606
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Most of the 11 CVEs are authorization and access control weaknesses affecting Kibana, including Missing/Incorrect Authorization (Fleet metadata disclosure, ML resource abuse, Entity Store API key creation, APM credential disclosure, AI Assistant Knowledge Base tampering, unauthorized ML data reads, disabled Entity Analytics monitoring) and resource-exhaustion issues in Agent Builder and Streams content packs, within the Elastic Stack. The remaining CVE is an Incorrect Permission Assignment for Critical Resource in Elastic Agent, affecting unprivileged Windows installations, that can lead to local privilege escalation to SYSTEM. Together, these CVEs can lead to unauthorized information disclosure, privilege escalation, data tampering, or denial of service.
Affected Products
All NetEye 4.x versions >= 4.25.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://discuss.elastic.co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109
- https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-135/390091
- https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-125/390090
- https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-122/390089
- https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054
- https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059
Patrick Harasser
Author
