Beveiligingsadvies

CVE-2026-72649

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-01 19:20:17

Laatst bijgewerkt 2026-09-02 03:55:56

Toegewezen door elastic

CVSS-score 8.8

Status PUBLISHED

Beschrijving

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

← Alle CVE's bekijken Bekijk op cve.org ↗