Elasticsearch ML component deserialization flaw enables RCE via crafted model artifact

Deserialization of untrusted data (CWE-502) in Elasticsearch's ML component lets a privileged user achieve RCE by submitting a crafted model artifact. Patched in 8.19.20, 9.4.5, and 9.5.1.

cat cve-2026-72649.json

Vendor: Elastic
Product: Elasticsearch
CVSS: 8.8
EPSS (exploit probability): 0.9%
Status: patched
Published: September 1, 2026
Source: https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087

Is CVE-2026-72649 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-72649 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).

Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison

CVE-2026-72649 timeline

2026-09-01Published to NVD
2026-09-03First 0dayNews coverage+2d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

Elastic’s advisory ESA-2026-114 documents a deserialization of untrusted data flaw (CWE-502) in the machine learning component of Elasticsearch. A user with elevated cluster privileges can submit a specially crafted trained model artifact; processing that artifact triggers object injection (CAPEC-586) and achieves code execution on the Elasticsearch node.

Affected versions

Versions before the patched releases in each maintained branch are vulnerable:

8.x before 8.19.20
9.4.x before 9.4.5
9.5.x before 9.5.1

Mitigation

Update to 8.19.20, 9.4.5, or 9.5.1, available via Elastic’s standard release channel. ML upload privilege scoping should also be reviewed, particularly in deployments that process model artifacts sourced from outside a controlled internal pipeline.

CVE / Vulnerability	Severity	CVSS	EPSS	Added to KEV
CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability	[ CRITICAL ]	9.8	99.9%	Mar 25, 2022
CVE-2014-3120 Elasticsearch Remote Code Execution Vulnerability	[ HIGH ]	8.1	88.6%	Mar 25, 2022

All 3 Elasticsearch known exploited vulnerabilities →

Related coverage

~/articles/2026-09-03-elasticsearch-cve-2026-72649-ml-rce

cloud

Elasticsearch Patches RCE in Machine Learning Module

Elastic patches CVE-2026-72649, a CVSS 8.8 deserialization flaw in the ML component that lets privileged users achieve RCE via crafted model artifacts.

Sep 3read →