Technology · Elastic
Elasticsearch vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 24 vulnerabilities in Elasticsearch: 0 in the last 7 days and 20 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-78607, was published on 1 September 2026.
- Last 7 days
- 0
- Last 90 days
- 20
- Critical, all time
- 2
- Exploited in the wild
- 2
About Elasticsearch
Elasticsearch is a distributed, RESTful search and analytics engine built on Apache Lucene.
Latest Elasticsearch vulnerabilities
- CVE-2026-78607: Elastic Elasticsearch missing authorization in custom inference servicemediumCVSS 5.4EPSS 0.3%
- CVE-2026-78605: Elasticsearch HTTP request smuggling leading to information disclosuremediumCVSS 5.9EPSS 0.3%
- CVE-2026-72649: Elasticsearch machine learning remote code execution via deserializationhighCVSS 8.8EPSS 0.9%
- CVE-2026-56143: Elastic Elasticsearch resource exhaustion denial of servicemediumCVSS 4.9EPSS 0.4%
- CVE-2026-72656: Elastic Elasticsearch ES|QL heap exhaustion denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72647: Elasticsearch uncontrolled recursion denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72645: Elastic Elasticsearch memory allocation denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inferencehighCVSS 8.8EPSS 0.6%
- CVE-2026-72639: Elasticsearch memory exhaustion in search highlightingmediumCVSS 6.5EPSS 0.4%
- CVE-2026-72638: Elasticsearch uncontrolled recursion denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72636: Elastic Elasticsearch uncontrolled recursion in wildcard matchingmediumCVSS 6.5EPSS 0.4%
- CVE-2026-63263: Elastic Elasticsearch denial of service in ES|QL enginemediumCVSS 6.5
- CVE-2026-63144: Elastic Elasticsearch uncontrolled recursion in query evaluation componentmediumCVSS 6.5
- CVE-2026-63140: Elastic Elasticsearch denial of service via reachable assertion in query parsingmediumCVSS 6.5
- CVE-2026-63136: Elastic Elasticsearch denial of service via excessive memory allocationmediumCVSS 6.5
- CVE-2026-56145: Elastic Elasticsearch denial of service in EQL sequence queriesmediumCVSS 6.5
- CVE-2026-56144: Elastic Elasticsearch incorrect authorization in ingest simulationmediumCVSS 5.3
- CVE-2026-49090: Elastic Elasticseach denial of service via bulk API resource exhaustionmediumCVSS 6.5
- CVE-2026-56149: Elastic Elasticsearch denial of service in machine learning componentmediumCVSS 4.9
- CVE-2026-56148: Elastic Elasticsearch denial of service via uncontrolled recursionmediumCVSS 6.5
- CVE-2025-37731: Elasticsearch PKI realm authentication bypass via crafted client certificatesmediumCVSS 6.8EPSS 0.2%
- CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursionmediumCVSS 6.5EPSS 0.5%
- CVE-2014-3120: Elasticsearch Improper Access Control vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 88.6%
- CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
Most severe Elasticsearch vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2014-3120: Elasticsearch Improper Access Control vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 88.6%
- CVE-2026-72649: Elasticsearch machine learning remote code execution via deserializationhighCVSS 8.8EPSS 0.9%
- CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inferencehighCVSS 8.8EPSS 0.6%
- CVE-2025-37731: Elasticsearch PKI realm authentication bypass via crafted client certificatesmediumCVSS 6.8EPSS 0.2%
- CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursionmediumCVSS 6.5EPSS 0.5%
- CVE-2026-72656: Elastic Elasticsearch ES|QL heap exhaustion denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72647: Elasticsearch uncontrolled recursion denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72645: Elastic Elasticsearch memory allocation denial of servicemediumCVSS 6.5EPSS 0.4%
- CVE-2026-72639: Elasticsearch memory exhaustion in search highlightingmediumCVSS 6.5EPSS 0.4%
Vulnerabilities per week
The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 29 Jun 2026 | 3 | 0 | |
| 6 Jul 2026 | 0 | 0 | |
| 13 Jul 2026 | 0 | 0 | |
| 20 Jul 2026 | 6 | 0 | |
| 27 Jul 2026 | 0 | 0 | |
| 3 Aug 2026 | 0 | 0 | |
| 10 Aug 2026 | 7 | 0 | |
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 4 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 |
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/elasticsearch.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Elasticsearch vulnerabilities", https://junglewise.ai/threats/technologies/elasticsearch, 26 September 2026.