CVE-2026-72649

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact to execute controlled logic with a broader system-call surface than intended. This requires an authenticated user with sufficient privileges to create and deploy trained models.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.