Important: Elastic Stack security update
Type/Severity
NetEye Product Security has rated this update as having a High security impact.
Topic
Updates for the Elastic Stack packages are now available for NetEye 4.
Security Fix for NetEye 4.50
9.5.6_neteye3.105.5-1
CVEs
Elasticsearch
- CVE-2026-115290
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVE-2026-115298
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-115710
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - CVE-2026-115715
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVE-2026-91403
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-114820
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Kibana
- CVE-2026-115292
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-115293
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVE-2026-115294
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - CVE-2026-115295
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-114406
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-111497
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Logstash
Logstash shares the two eMudhra trust-store CVEs listed under Elasticsearch (CVE-2026-91403, CVE-2026-114820) through its bundled Java runtime.
The most severe of the 12 unique CVEs is an Out-of-bounds Write in the Node.js Brotli decoder bundled with Kibana, which can lead to remote code execution when Kibana receives a crafted compressed response from an attacker-controlled upstream. Three further CVEs are Improper Certificate Validation issues caused by the compromised eMudhra (emSign) root certificates shipped in the Java runtime bundled with Elasticsearch and Logstash, and the Node.js runtime bundled with Kibana; they allow a man-in-the-middle attacker to intercept or modify TLS-protected traffic with forged certificates. Elasticsearch is also affected by an Uncontrolled Recursion in the Remote Cluster Server interface, which an unauthenticated attacker can use to crash nodes, an Allocation of Resources Without Limits or Throttling in the phonetic analysis plugin that exhausts node heap memory, an Incorrect Authorization that fails to apply field-level security to constant_keyword fields, and a Use of Cache Containing Sensitive Information that leaks query results across users with different field-level security restrictions. Kibana additionally suffers a Path Traversal in Fleet that lets a low-privileged user trigger unauthorized deletion of resources, two Authorization Bypass Through User-Controlled Key issues that expose Machine Learning job details and connector execution logs across spaces, and an Insertion of Sensitive Information Into Sent Data in Observability onboarding that can disclose the Elasticsearch credentials used by Kibana. Together, these CVEs can lead to remote code execution, TLS traffic interception, unauthorized information and credential disclosure, or denial of service.
Affected Products
All NetEye 4.x versions >= 4.31.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356
- https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-203/391357
- https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358
- https://discuss.elastic.co/t/kibana-9-4-9-9-5-6-security-update-esa-2026-205/391359
- https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360
- https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362
- https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-210/391363
- https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-227/391364
- https://discuss.elastic.co/t/logstash-8-19-24-9-4-9-9-5-6-security-update-esa-2026-228/391365
- https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-229/391366
- https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-232/391369
- https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372
Patrick Harasser
Author
