CVE details
CVE-2026-72649
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
- Score
- 8.8 high
- Published
- 2026-09-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/elasticsearch8 | elasticsearch8 | 8.19.24 | fixed by update | elastic@FreeBSD.org |
| textproc/elasticsearch94 | elasticsearch94 | 9.4.9 | fixed by update | elastic@FreeBSD.org |