OtherHigh
CVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead…
- Occurred
- Sep 1, 2026
- Published
- Sep 1, 2026
- Source
- NVD CVE
Summary
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
Tags
- CVE
- CVE-2026-72649
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 95%
Rationale: CVE describes a critical security vulnerability in Elasticsearch ML component enabling remote code execution, which is a software security issue rather than an AI safety incident.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8