An authenticated user can trigger stored Cross-Site Scripting in Elastic Kibana, potentially leading to unauthorized data access or session compromise.

This vulnerability is a stored XSS flaw (CWE-79) resulting from improper neutralization of user-supplied input. An attacker with low privileges can inject malicious scripts that execute within the context of another user's session when viewing the affected page.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially resulting in the theft of sensitive session tokens or unauthorized actions performed on behalf of the user. With a CVSS score of 8.7, this vulnerability poses a significant risk to the integrity and confidentiality of the Kibana environment and the data managed within it.

Immediate Action: Upgrade to the patched versions specified in the Elastic security advisory ESA-2025-17, which include versions 8.18.8, 8.19.5, 9.0.8, or 9.1.5.

Proactive Monitoring: Monitor Kibana access logs for unusual patterns or attempts to inject script tags into input fields or saved objects.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter common XSS payloads.

Public Exploit Available: Unknown

Given the High severity rating, administrators must prioritize updating their Kibana instances to the versions identified in the vendor advisory. Failure to apply these updates leaves the platform vulnerable to session-based attacks that can compromise administrative control and sensitive visualization data.