Is CVE-2026-72642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72642 being exploited in the wild.

How severe is CVE-2026-72642?

High severity, with a CVSS score of 8.8, published 13 August 2026.

Which products and versions are affected?

Elasticsearch 8.19.0–8.19.19, 9.4.0–9.4.4, 9.5.0.

Is there a fix for CVE-2026-72642?

A patch was published on 2026-08-13: Elasticsearch 8.19.20, 9.4.5, and 9.5.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72642 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-72642?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inference

CVE-2026-72642 · Severity: high · CVSS 8.8 · Published 2026-08-13

Elasticsearch's machine learning inference engine accepts uploaded model files that can reference memory addresses outside safe bounds. A trusted administrator or model provider could craft a malicious model to crash the inference process or execute arbitrary code. This affects deployments with machine learning enabled and trusted model upload capabilities.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-72642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72642 being exploited in the wild.
How severe is CVE-2026-72642?: High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?: Elasticsearch 8.19.0–8.19.19, 9.4.0–9.4.4, 9.5.0.
Is there a fix for CVE-2026-72642?: A patch was published on 2026-08-13: Elasticsearch 8.19.20, 9.4.5, and 9.5.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72642 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-72642?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-of-out-of-range pointer offset (CWE-823) in the native inference process used by Elasticsearch to evaluate uploaded machine learning models. The flaw exists in model operations that compute memory addresses from offsets supplied within the model file without validating that these offsets remain within allocated storage bounds. An authenticated user with privileges to upload and deploy trained models can craft a malicious model that performs unauthorized reads and writes to heap memory. This results in heap corruption leading to process crash (denial of service), or with careful heap layout manipulation, arbitrary code execution within the inference process context. The vulnerability requires authentication and machine learning to be enabled; patches are available in versions 8.19.20, 9.4.5, and 9.5.1.

Affected products

Elastic Elasticsearch 8.19.0–8.19.19, 9.4.0–9.4.4, 9.5.0

Timeline

2026-08-13: disclosed: CVE-2026-72642 and advisory ESA-2026-123 published
2026-08-13: patched: Elasticsearch 8.19.20, 9.4.5, and 9.5.1 released with fix

References

https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.