Security Advisory

CVE-2026-72649

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-01 19:20:17

Last updated 2026-09-02 03:55:56

Assigner elastic

CVSS score 8.8

State PUBLISHED

Description

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

← Browse all CVEs View on cve.org ↗