How severe is CVE-2026-26932?

CVE-2026-26932 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-26932 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26932?

CVE-2026-26932 affects Elasticsearch Packetbeat. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-26932?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-26932 have an EU (EUVD) identifier?

Yes. CVE-2026-26932 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8864.

When was CVE-2026-26932 published?

CVE-2026-26932 was published on 2026-02-26 and last updated on 2026-06-17.

CVE-2026-26932

CVE-2026-26932 is a medium-severity vulnerability in Elasticsearch Packetbeat with a CVSS 3.x base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.

Key facts

Severity: Medium (CVSS 3.x base score 5.7)
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-8864
Weakness: CWE-129
Affected product: Elasticsearch Packetbeat
Published: 2026-02-26
Last modified: 2026-06-17

Description

Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

Frequently asked questions

What is CVE-2026-26932?: Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.
How severe is CVE-2026-26932?: CVE-2026-26932 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-26932 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26932?: CVE-2026-26932 affects Elasticsearch Packetbeat. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-26932?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-26932 have an EU (EUVD) identifier?: Yes. CVE-2026-26932 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8864.
When was CVE-2026-26932 published?: CVE-2026-26932 was published on 2026-02-26 and last updated on 2026-06-17.

References

https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247

Affected products (1)

cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*

More vulnerabilities in Elasticsearch Packetbeat

CVE-2017-11480 — High (CVSS 7.5): Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If…
CVE-2025-68382 — Medium (CVSS 6.5): Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the…
CVE-2025-68381 — Medium (CVSS 6.5): Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow…
CVE-2026-26933 — Medium (CVSS 5.7): Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of…
CVE-2025-68388 — Medium (CVSS 5.3): Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause…

All CVEs affecting Elasticsearch Packetbeat →

Other CWE-129 (Improper Validation of Array Index) vulnerabilities

CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.

Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →