An authenticated cross-site scripting vulnerability in Elastic Kibana allows attackers to execute arbitrary scripts in user browsers, posing a risk of session hijacking and unauthorized data access.

This is a cross-site scripting (CWE-79) flaw affecting the Vega component of Kibana. It allows an authenticated user to bypass previous security mitigations and inject malicious scripts that execute within the context of other users' browser sessions.

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and confidentiality of user sessions within the Kibana dashboard. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to unauthorized actions performed on behalf of legitimate users, including administrators, potentially resulting in data exfiltration or administrative configuration changes.

Immediate Action: Update Elastic Kibana to version 8.19.9, 9.1.9, or 9.2.3 as specified in the official Elastic security advisory ESA-2025-34.

Proactive Monitoring: Monitor Kibana access and audit logs for suspicious activity, particularly focusing on unusual input patterns or unexpected script execution within the Vega visualization environment.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and filter malicious payloads in user-supplied input fields, specifically targeting common XSS vectors.

Public Exploit Available: No

The vulnerability presents a significant risk to the security of Kibana deployments by enabling script injection through a previously hardened component. Organizations should prioritize applying the provided security updates immediately to protect their environments from potential exploitation. Consistent patch management and restricted user access controls remain the most effective strategies for mitigating this type of application-layer risk.