CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

Affedted products & versions: OpenSearch Dashboards (open-source, self-managed): - Affected: v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, v.2.6.0, v2.7.0, v2.8.0, v2.9.0, v2.10.0, v2.11.0, v2.12.0, v2.13.0, v2.14.0, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v3.0.0, v3.1.0, v3.2.0, v3.3.0, v3.4.0, v3.5.0 - Fixed: v2.19.5 and v3.6.0 Amazon OpenSearch Service (AWS Managed): - Affected: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0 - Fixed: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0 and v3.1.0, v3.3.0, v3.5.0 Amazon OpenSearch Serverless: - Not affected Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Sep 9, 2026 at 9:50 PM UTC
   • The vendor changed the advisory's last-updated date.
2. Sep 9, 2026 at 9:30 PM UTC
   • The vendor changed the advisory's last-updated date.

1. Sep 8, 2026 at 8:10 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

2. Sep 9, 2026 at 9:30 PM UTC
   Published by AWS

   The publication date reported by the vendor.

3. Sep 13, 2026 at 4:30 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.