CVE-2019-7609VulnerabilityPublished 01/10/2022Updated 10/24/2026

CVE-2019-7609: Kibana Arbitrary Code Execution

Affects Elastic KibanaSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/10/2022
KEV deadline: 07/10/2022
EPSS: 95.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-7609 (opens in a new tab)

Description

CVE-2019-7609 is a high-severity vulnerability in Kibana's Timelion visualizer that allows arbitrary code execution. This flaw has been exploited in the wild, posing a significant risk to affected systems. No specific affected versions or patch information are provided in the available data.

Summary

Kibana contains an arbitrary code execution vulnerability in the Timelion visualizer component, identified as CVE-2019-7609. This vulnerability allows attackers to execute arbitrary code remotely. The flaw is classified under CWE-94 (Improper Control of Generation of Code). Exploitation of this vulnerability has been observed in the wild. No explicit patch or remediation details are provided in the source data.

Impact

Successful exploitation of this vulnerability enables remote attackers to execute arbitrary code on the affected Kibana instance, potentially leading to full system compromise. Given that exploitation has been observed in the wild, the risk to organizations running vulnerable Kibana versions is high.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict access to the Kibana Timelion visualizer and monitor for suspicious activity related to this component.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:19 UTC

Weaknesses

References

Related threats