CVE-2026-72642: Elastic Elasticsearch vulnerability (CVSS 8.8)

Description

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Elastic Elasticsearch≥ 8.19.0 < 8.19.20 · ≥ 9.4.0 < 9.4.5 · ≥ 9.5.0 < 9.5.1

Remediation

Fixed in

Elastic Elasticsearch≥ 8.19.20

Patch & vendor advisories

https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504

References

https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-72642 being actively exploited?

CVE-2026-72642 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.60%.

How severe is CVE-2026-72642?

CVE-2026-72642 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.60% probability of exploitation.

Which products are affected by CVE-2026-72642?

Affected products include Elastic Elasticsearch.

How do I fix CVE-2026-72642?

Upgrade affected software to a fixed version, for example Elastic Elasticsearch 8.19.20 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-72642 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo