CVE-2019-7609: Kibana Timelion visualizer code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, network-reachable with no authentication or user interaction, listed in CISA KEV, and EPSS above 0.95.

What it is

Kibana before 5.6.15 and 6.6.1 contains an arbitrary code execution flaw in the Timelion visualizer. An attacker who can reach the Timelion application can send a crafted request that executes JavaScript and, per the description, may run arbitrary commands with the permissions of the Kibana process. Because the flaw is network-reachable and needs no authentication or user interaction, it is a severe exposure for any internet- or broadly reachable Kibana instance.

Impact

An attacker gains code execution on the Kibana host under the Kibana process account, which can lead to full compromise of the host and any data or credentials the process can reach.

Attack surface

Reached over the network through the Timelion application endpoint; the CVSS vector indicates no privileges and no user interaction are required. The description notes the attacker needs access to the Timelion application, so exposure depends on whether that interface is reachable.

Exploitation

CVE-2019-7609 is listed in CISA KEV (added 2022-01-10) and has an EPSS 30-day probability of 0.95338 (99.863rd percentile), and a public exploit reference is tagged Exploit. This indicates active exploitation and a very high likelihood of attempted exploitation.

What to do

• Upgrade Kibana to 5.6.15 or 6.6.1 or later as directed by the vendor advisory.
• If immediate upgrade is not possible, restrict network access to Kibana and the Timelion application to trusted users and networks.
• Disable or block the Timelion application if it is not required.
• Run Kibana with least privilege and isolate it from sensitive hosts and data.
• Track CISA KEV remediation due date (2022-07-10) and confirm patched status across all deployments.

Detection

• Monitor Kibana and Timelion request logs for unusual or crafted requests targeting the Timelion endpoint.
• Alert on unexpected child processes or command execution spawned by the Kibana process.
• Watch for outbound network connections from the Kibana host that are inconsistent with normal operation.
• Audit for unauthorized access attempts to the Timelion application from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.