Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception

Elastic published 14 security advisories covering multiple vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint — most notably CVE-2026-102406 (Kibana authorization bypass, CVSS 8.8) that can allow cross-tenant data interception via malicious Fleet packages, an Elasticsearch cross-cluster API key access issue (CVE-2026-103009), several DoS flaws, and an Endpoint crash bug affecting Windows malware protection; patches and remediation guidance are provided and administrators are advised to upgrade and restrict custom package uploads.