Elasticsearch Patches RCE in Machine Learning Module

Patch confirmed. Elastic published ESA-2026-114 on September 1, addressing CVE-2026-72649 in the Elasticsearch machine learning component. CVSS 8.8, HIGH.

The flaw is a deserialization of untrusted data issue (CWE-502). A user with elevated privileges submits a crafted trained model artifact; object injection (CAPEC-586) executes on the node that processes it. Existing elevated access is a prerequisite, per the advisory.

Patched releases: 8.19.20, 9.4.5, and 9.5.1. Versions before those release points in each active branch are vulnerable.

The exposure depends on deployment shape. ML pipelines that ingest model artifacts from outside a tightly controlled internal process are the target scenario. In multi-tenant Elasticsearch clusters, accounts with ML upload rights become a lateral movement path if any such account is compromised. Deserialization bugs in infrastructure components that process externally-supplied artifacts have shown poor outcomes once any privileged account is in scope: JFrog Artifactory CVE-2026-82329 was actively exploited within days of disclosure, and a CVSS 9.9 object injection flaw in StackGres followed the same pattern.

Elasticsearch is a common layer in SIEM stacks, log aggregation, and ML inference pipelines. The ML component is not universally enabled, but where it is, and where model upload access is not tightly scoped, CVE-2026-72649 is a code execution path that ESA-2026-114 closes. For related coverage on attacks against data platform infrastructure, see Langflow actively exploited for credential theft.