← Vulnerability Intelligence

CVE-2019-7609

Critical 10.0 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Kibana Arbitrary Code Execution
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

Metrics

CVSS 3.1
10.0 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS — exploit probability
95% (percentile: 100) as of 1 November 2026
CWE
CWE-94

Affected products

elastic: kibana; redhat: openshift container platform

References