Uncaught Exception in Kibana Cases Leading to Denial of Service (CVE-2026-49096)

CVE-2026-49096 is an uncaught exception vulnerability in Kibana Cases caused by improper handling of malformed link syntax in case comments. An authenticated user with permission to comment can store a specially crafted comment that, when formatted for display, causes an unhandled error. This error prevents the affected case from being displayed, resulting in a denial of service condition for all users attempting to access that case. The vulnerability arises from lack of input validation and error handling in the comment rendering process.

The vulnerability leads to denial of service by making a case inaccessible to all users once a malicious comment is stored. This disrupts normal case management workflows and could impede incident response or investigation activities relying on Kibana Cases. There is no indication of data disclosure or privilege escalation from the provided information.

A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.20 or later, 9.3.5 or later, or 9.4.2 or later as appropriate. Until patched, administrators should monitor and remove any malformed comments causing this issue. No other mitigation steps are indicated by the vendor advisory.