Is CVE-2026-49095 actively exploited?

No active exploitation of CVE-2026-49095 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49095 be exploited remotely?

Yes. CVE-2026-49095 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49095?

CVE-2026-49095 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-49095

MEDIUM

CVE-2026-49095

CWE-20Published: May 28, 2026· Updated: Jun 1, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.1th

Official Description

Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.

NVD Source

Technical Analysis

CVE-2026-49095 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 6.5.