# CVE-2026-72676: Improper Control of Generation of Code in Fleet Server Leading to Code Injection

> CVE-2026-72676: Improper Control of Generation of Code in Fleet Server Leading to Code Injection. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-72676
Last updated: 2026-09-04T20:21:02Z

- Published: 2026-08-13 19:11 UTC · Updated: 2026-09-04 20:21 UTC · Assigner: elastic
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.55%, 46th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-94

## Description

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

## Affected vendors and products

- Elastic: Fleet Server

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-72676)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72676)
- [https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-72676 · Markdown: https://rewindex.com/cve/CVE-2026-72676.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-72676 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:04:36.523Z