[NEW] [high] Elasticsearch: Multiple Vulnerabilities

highCVE-2026-56143 CVE-2026-72649 CVE-2026-78605 CVE-2026-78607

An attacker can exploit multiple vulnerabilities in Elasticsearch to perform a Denial of Service attack, execute arbitrary code, bypass security measures, or disclose confidential information.

CSIRTS triage

vendor: Elastic product: Elasticsearch Denial of service Remote code execution Authentication bypass Information disclosure

What: Multiple vulnerabilities in Elasticsearch enable Denial of Service, arbitrary code execution, security bypass, and information disclosure.
Who is affected: Elasticsearch deployments across all exposed instances.
Urgency: High severity with multiple critical attack vectors including code execution; immediate patching required.
Action: Apply the latest security patches for Elasticsearch.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Elasticsearch

Get an email when a new Elasticsearch advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3131

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-56143	coverage & exploitation status	NVD · CVE.org
CVE-2026-72649	coverage & exploitation status	NVD · CVE.org
CVE-2026-78605	coverage & exploitation status	NVD · CVE.org
CVE-2026-78607	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Elasticsearch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-56143: Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Ser…msrc · 2026-09-02
highCVE-2026-72649: Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Executionmsrc · 2026-09-02
mediumCVE-2026-78607: Missing Authorization in Elasticsearch Leading to Information Disclosuremsrc · 2026-09-02
mediumCVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to info…nvd · 2026-09-01
mediumCVE-2026-78605: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticse…nvd · 2026-09-01
highCVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component ca…nvd · 2026-09-01