CVE-2026-72649

Summary

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

Affected Software

VendorProductVersion RangeStatus
ElasticElasticsearch8.0.0 <= 8.19.19affected
ElasticElasticsearch9.0.0 <= 9.4.4affected
ElasticElasticsearch9.5.0affected

Weaknesses

  • CWE-502: CWE-502 Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References