Is CVE-2026-72649 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72649?

CVE-2026-72649 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-72649

Description

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.