CVE-2026-72649CWE-502insecure-deserialization

CVE-2026-72649

High · published September 2, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00918 · 59.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-02T00:17Z
Affected products (3)
ProductVersionsFixed in
elastic/elasticsearch≥ 8.0.0, < 8.19.208.19.20
elastic/elasticsearch≥ 9.0.0, < 9.4.59.4.5
elastic/elasticsearchall versions—
References (1)
https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087 · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 01 SEP 19:20Z
    Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
    cvelistv5