Important: Elastic Stack security update
Type/Severity
NetEye Product Security has rated this update as having a High security impact.
Topic
Updates for the Elastic Stack packages are now available for NetEye 4.
Security Fix for NetEye 4.50
9.5.5_neteye3.105.3-1
CVEs
Elastic Agent
- CVE-2026-102413
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Elasticsearch
- CVE-2026-103009
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - CVE-2026-103008
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-103005
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-102409
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-102404
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-102408
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Kibana
- CVE-2026-102412
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Most of the 8 CVEs are resource-exhaustion weaknesses in Elasticsearch. These are Uncontrolled Recursion, Uncontrolled Resource Consumption, Memory Allocation with Excessive Size Value, and Inefficient Regular Expression Complexity, found in scripted geometry runtime fields, the Connector API, and the ES|QL query engine and its CHUNK function. They let a low-privileged authenticated user crash a node or degrade it. Elasticsearch is also affected by an Authorization Bypass Through User-Controlled Key in cross-cluster search with the RCS 2.0 model, which can expose the contents of unauthorized indices. The remaining CVEs are an Incorrect Authorization in Kibana, which lets users with limited Fleet privileges get the SSL private keys of Fleet Server hosts, and an Uncaught Exception in Elastic Endpoint, which can repeatedly crash Elastic Defend on Windows hosts with CJK locales. Together, these CVEs can lead to unauthorized information disclosure, credential exposure, or denial of service.
Affected Products
All NetEye 4.x versions >= 4.25.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859
- https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862
- https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863
- https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866
- https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868
- https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869
- https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872
- https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874
Patrick Harasser
Author
