[NEW] [high] Elasticsearch: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in Elasticsearch enable arbitrary code execution and denial of service attacks.

Who is affected

All Elasticsearch clusters running affected versions are vulnerable.

Urgency

High severity RCE vulnerabilities require immediate attention to prevent cluster compromise.

Action

Apply Elasticsearch security updates addressing CVE-2026-72636 through CVE-2026-72678.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-14

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2841

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-726360.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726380.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726390.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726420.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726450.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726470.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726560.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726780.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726790.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-726830.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• mediumCVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small re…nvd
• mediumCVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request …nvd
• mediumCVE-2026-72685: A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to …nvd
• mediumCVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a …nvd
• mediumCVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke th…nvd
• mediumCVE-2026-72679: Elasticsearch does not apply its configurable input length restriction to a user-supplied patt…nvd
• mediumCVE-2026-72678: Elasticsearch does not validate a size value taken from a user-supplied input before that valu…nvd
• mediumCVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elastic…nvd
• mediumCVE-2026-72647: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized…nvd
• mediumCVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of s…nvd
• highCVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning mod…nvd
• mediumCVE-2026-72639: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search hi…nvd

Recent advisories for Elasticsearch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory toolaws · 2026-08-20
• mediumCVE-2026-76211: phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API rea…nvd · 2026-08-19
• mediumCVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small re…nvd · 2026-08-13
• mediumCVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request …nvd · 2026-08-13
• mediumCVE-2026-72685: A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to …nvd · 2026-08-13
• mediumCVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a …nvd · 2026-08-13

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25