Monitoring and logging: vulnerabilities and fixes

Grafana, Kibana, Splunk, Prometheus, Zabbix and Nagios. 62 CVEs tracked.

Monitoring and logging has 62 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 42. Most recent: 2026-10-21. Highest priority: CVE-2026-63087 (score 56/100).

• CVE-2026-63087 CRITICAL 9.8 Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers t
• CVE-2026-67342 CRITICAL 9.8 ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series
• CVE-2022-43552 MEDIUM 5.9 UPGRADE UPGRADE A use after free vulnerability exists in curl <7.87.0
• CVE-2026-76311 CRITICAL 9.4 UPGRADE In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an emb
• CVE-2026-67436 HIGH 8.3 Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring s
• CVE-2026-15583 HIGH 8.6 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the serve
• CVE-2026-76404 CRITICAL 9.1 UPGRADE In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrar
• CVE-2026-19111 HIGH 8.1 Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon
• CVE-2026-49835 MEDIUM 5.9 UPGRADE Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps
• CVE-2026-74038 HIGH 7.1 UPGRADE Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers
• CVE-2026-74044 MEDIUM 6.5 UPGRADE Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to d
• CVE-2026-76290 HIGH 7.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated r
• CVE-2026-74039 MEDIUM 6.5 UPGRADE Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated
• CVE-2026-76288 HIGH 7.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a
• CVE-2026-76291 HIGH 8.8 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the sch
• CVE-2026-76298 HIGH 8.8 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk
• CVE-2026-52817 HIGH 7.0 Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems
• CVE-2026-74046 MEDIUM 4.9 UPGRADE Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function withi
• CVE-2026-56145 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Alloc
• CVE-2026-63139 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (
• CVE-2026-63260 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (
• CVE-2026-63261 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (
• CVE-2026-63263 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Dat
• CVE-2026-72663 MEDIUM 6.5 UPGRADE Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulati
• CVE-2026-15746 MEDIUM 6.5 Strands Agents is an open-source Python SDK for building and running AI agents
• CVE-2026-42397 MEDIUM 6.5 UPGRADE Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via E
• CVE-2026-56147 HIGH 7.1 UPGRADE Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disc
• CVE-2026-63136 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Alloc
• CVE-2026-63140 MEDIUM 6.5 UPGRADE Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPE
• CVE-2026-63144 MEDIUM 6.5 UPGRADE Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search
• CVE-2026-72653 MEDIUM 6.5 UPGRADE Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Exc
• CVE-2026-76259 HIGH 8.8 UPGRADE In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with
• CVE-2026-76293 HIGH 7.2 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edi
• CVE-2026-76390 MEDIUM 5.3 UPGRADE In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could
• CVE-2026-76406 MEDIUM 5.9 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an
• CVE-2026-76307 HIGH 7.2 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could u
• CVE-2026-76306 HIGH 7.5 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Repres
• CVE-2026-76289 MEDIUM 6.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76292 MEDIUM 6.5 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions be
• CVE-2026-76305 MEDIUM 6.5 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view ap
• CVE-2026-67433 MEDIUM 5.8 Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring s
• CVE-2026-56144 MEDIUM 5.3 UPGRADE Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileg
• CVE-2026-63141 MEDIUM 6.3 UPGRADE Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect conf
• CVE-2026-76308 MEDIUM 6.5 In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition throug
• CVE-2026-63142 MEDIUM 5.0 UPGRADE Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to th
• CVE-2026-56146 MEDIUM 5.4 UPGRADE Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlis
• CVE-2026-76303 MEDIUM 5.7 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store att
• CVE-2026-76376 MEDIUM 4.3 In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run act
• CVE-2026-21723 MEDIUM 5.3 The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute
• CVE-2026-63143 MEDIUM 4.3 UPGRADE Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse
• CVE-2026-49092 MEDIUM 4.3 UPGRADE Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information
• CVE-2026-63145 MEDIUM 4.3 UPGRADE Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and not
• CVE-2026-63259 MEDIUM 4.3 UPGRADE Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via us
• CVE-2026-63262 MEDIUM 4.3 UPGRADE Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user
• CVE-2026-76287 MEDIUM 5.4 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline
• CVE-2026-76294 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76296 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin"
• CVE-2026-76383 MEDIUM 4.3 In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role
• CVE-2026-76295 MEDIUM 4.3 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions be
• CVE-2026-76384 MEDIUM 4.3 In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with
• CVE-2026-76304 MEDIUM 4.3 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Au
• CVE-2026-76297 MEDIUM 4.2 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a

FAQ

How do I fix Monitoring and logging vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Monitoring and logging being exploited right now?

None of the tracked Monitoring and logging CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Monitoring and logging CVE should I patch first?

CVE-2026-63087 currently ranks highest (56/100): Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers t.

Software in this group

People search for: grafana, kibana, splunk, prometheus, zabbix, logging.

← Back to latest CVEs