The vulnerability present in Kibana Fleet allows a specially crafted bulk retrieval request to trigger redundant database retrieval operations that consume memory until the server crashes. An attacker with a viewer‑level role—which provides read access to agent policies—can exploit this flaw. The resulting denial of service makes Kibana unavailable to all users.

Elastic Kibana is the affected product. No specific version information is listed, so any installation of Kibana that includes Fleet is potentially vulnerable. Users should verify their deployments against vendor advisories.

The CVSS base score of 6.5 indicates moderate severity, while an EPSS of less than 1% reflects a low likelihood of broad exploitation. The flaw is not yet catalogued in CISA’s KEV list. Exploitation requires a viewer‑level account and the ability to send the crafted bulk request, suggesting the attack vector is likely internal or via compromised credentials rather than remote network intrusion. Given the moderate impact and low exploitation probability, the risk is considered moderate, warranting timely patching.