# CVE-2026-49096: Uncaught Exception in Kibana Cases Leading to Denial of Service

> CVE-2026-49096: Uncaught Exception in Kibana Cases Leading to Denial of Service. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-49096
Last updated: 2026-09-02T18:49:51Z

- Published: 2026-08-13 19:14 UTC · Updated: 2026-09-02 18:49 UTC · Assigner: elastic
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- EPSS: 0.29%, 21th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-248

## Description

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-49096)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-49096)
- [https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-49096 · Markdown: https://rewindex.com/cve/CVE-2026-49096.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-49096 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:10.050Z