Elastic has released a critical security update to address a severe prototype pollution vulnerability in Kibana, the data visualization tool for Elasticsearch. With a CVSS score of 9.9/10, the flaw, tracked as CVE-2025-25012, enables attackers to execute arbitrary code by exploiting crafted file uploads and malicious HTTP requests. Affected versions range from 8.15.0 to 8.17.3, with exploitability varying based on user roles. In earlier versions, users with the Viewer role are vulnerable, while in versions 8.17.1 and 8.17.2, the risk is limited to those with elevated privileges, including fleet all, integrations all, and actions execute advanced connectors. Organizations relying on Kibana for data analysis, monitoring, and security intelligence are at significant risk, as this vulnerability could lead to data breaches, system compromise, and operational disruptions. Elastic has patched the issue in version 8.17.3, and users are strongly urged to upgrade immediately. For those unable to update right away due to the effects on critical business processes, mitigation measures include disabling the Integration Assistant feature (“xpack.integration_assistant.enabled: false”) and enforcing strict access controls. Given Kibana’s previous history of critical vulnerabilities, including similar prototype pollution and deserialization flaws in 2024, security teams must act quickly to implement best practices such as monitoring system logs, restricting user permissions, and segmenting networks to limit exposure. CTIX analysts urge all affected administrators to ensure that they have a plan for updating their instances or applying mitigation measures until the patch can be applied.