[NEW] [high] Elasticsearch: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in Elasticsearch enable arbitrary code execution and denial of service attacks.

Who is affected

All Elasticsearch clusters running affected versions are vulnerable.

Urgency

High severity RCE vulnerabilities require immediate attention to prevent cluster compromise.

Action

Apply Elasticsearch security updates addressing CVE-2026-72636 through CVE-2026-72678.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-14

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2841

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-726360.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726380.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726390.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726420.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726450.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726470.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726560.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726780.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726790.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726830.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• mediumCVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small re…nvd
• mediumCVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request …nvd
• mediumCVE-2026-72685: A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to …nvd
• mediumCVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a …nvd
• mediumCVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke th…nvd
• mediumCVE-2026-72679: Elasticsearch does not apply its configurable input length restriction to a user-supplied patt…nvd
• mediumCVE-2026-72678: Elasticsearch does not validate a size value taken from a user-supplied input before that valu…nvd
• mediumCVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elastic…nvd
• mediumCVE-2026-72647: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized…nvd
• mediumCVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of s…nvd
• highCVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning mod…nvd
• mediumCVE-2026-72639: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search hi…nvd

Recent advisories for Elasticsearch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• mediumCVE-2026-89261: MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search servi…nvd · 2026-09-11
• mediumGHSA-f2cp-m7mv-8jpv: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiersghsa · 2026-09-10
• high[UPDATE] [hoch] Elasticsearch: Mehrere Schwachstellencert-bund · 2026-09-09
• mediumCVE-2026-86079: n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the…nvd · 2026-09-08
• mediumCVE-2026-56143: Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Ser…msrc · 2026-09-08
• highCVE-2026-72649: Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Executionmsrc · 2026-09-08

More from CERT-Bund (BSI) Security Advisories

• high[UPDATE] [hoch] Red Hat Enterprise Linux (postgis, virtuoso-opensource): Mehrere Schwachstellen2026-09-11
• medium[UPDATE] [mittel] Red Hat Enterprise Linux: Mehrere Schwachstellen2026-09-11
• medium[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Denial of Service2026-09-11
• medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen2026-09-11
• high[UPDATE] [hoch] OpenSSL: Mehrere Schwachstellen2026-09-11