Important: Elastic Stack security update
Type/Severity
NetEye Product Security has rated this update as having a Medium security impact.
Topic
Updates for the Elastic Stack packages are now available for NetEye 4.
Security Fix for NetEye 4.48
9.4.4_neteye3.101.4-1
CVEs
Elasticsearch
- CVE-2026-63263
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-63144
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-63140
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-56145
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-56144
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Kibana
- CVE-2026-63262
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-63261
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-63260
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-63259
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-63145
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVE-2026-63143
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-63142
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - CVE-2026-63141
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVE-2026-63139
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-42397
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Most of the 15 CVEs are Denial of Service vulnerabilities affecting Elasticsearch (ES|QL, EQL, search-query parsing) and Kibana (Machine Learning, Canvas, Entity Analytics), within the Elastic Stack. The remaining CVEs relate to authorization and access-control weaknesses in Kibana, including Missing/Incorrect Authorization and an SSRF via an incomplete input denylist, that can lead to unauthorized information disclosure or integrity compromise.
Affected Products
All NetEye 4.x versions >= 4.31.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577
- https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571
- https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565
- https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556
- https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-56/388555
- https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576
- https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575
- https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574
- https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573
- https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572
- https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569
- https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-66/388568
- https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566
- https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560
- https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554
Gabriele Bocchi
Software Engineer - IT System & Service Management Solutions at Würth IT Italy
Author
