CVE-2026-72649

Elasticsearch's machine learning component (CVE-2026-72649) contains a deserialization-of-untrusted-data flaw (CWE-502) that can lead to remote code execution via object injection. An attacker who is an authenticated user with sufficient privileges to create and deploy trained models can submit a specially crafted trained model artifact, causing attacker-controlled logic to execute with a materially broader system-call surface than intended. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8 High, network vector, low privileges required, no user interaction). Only Elasticsearch deployments where the machine learning feature is in use and model-creation/deployment privileges are granted to untrusted or compromised accounts are meaningfully exposed. As of this analysis there is no known public proof-of-concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported; EPSS currently estimates roughly a 0.6% probability of exploitation within 30 days.

What to do: Inventory your Elasticsearch clusters for use of the machine learning feature and review which users hold privileges to create and deploy trained models, restricting them to trusted operators and, ideally, trusted model sources. Apply the patched Elasticsearch release identified in Elastic's security advisory as soon as it is available, prioritizing ML-enabled clusters (particularly security/SIEM deployments). Until patched, treat trained-model artifact uploads as untrusted input and monitor model-creation and deployment activity for anomalies.