How severe is CVE-2026-26933?

CVE-2026-26933 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-26933 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26933?

CVE-2026-26933 affects Elasticsearch Packetbeat. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-26933?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-26933 have an EU (EUVD) identifier?

Yes. CVE-2026-26933 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13142.

When was CVE-2026-26933 published?

CVE-2026-26933 was published on 2026-03-19 and last updated on 2026-06-17.

CVE-2026-26933

CVE-2026-26933 is a medium-severity vulnerability in Elasticsearch Packetbeat with a CVSS 3.x base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.

Key facts

Severity: Medium (CVSS 3.x base score 5.7)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-13142
Weakness: CWE-129
Affected product: Elasticsearch Packetbeat
Published: 2026-03-19
Last modified: 2026-06-17

Description

Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.

Frequently asked questions

What is CVE-2026-26933?: Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
How severe is CVE-2026-26933?: CVE-2026-26933 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-26933 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26933?: CVE-2026-26933 affects Elasticsearch Packetbeat. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-26933?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-26933 have an EU (EUVD) identifier?: Yes. CVE-2026-26933 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13142.
When was CVE-2026-26933 published?: CVE-2026-26933 was published on 2026-03-19 and last updated on 2026-06-17.

References

https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533

Affected products (1)

cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*

More vulnerabilities in Elasticsearch Packetbeat

CVE-2017-11480 — High (CVSS 7.5): Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If…
CVE-2025-68382 — Medium (CVSS 6.5): Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the…
CVE-2025-68381 — Medium (CVSS 6.5): Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow…
CVE-2026-26932 — Medium (CVSS 5.7): Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service…
CVE-2025-68388 — Medium (CVSS 5.3): Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause…

All CVEs affecting Elasticsearch Packetbeat →

Other CWE-129 (Improper Validation of Array Index) vulnerabilities

CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.

Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →