Technology · Elastic
Elasticsearch vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 45 vulnerabilities in Elasticsearch: 0 in the last 7 days and 25 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-115715, was published on 3 November 2026. 4 vulnerabilities in the last four weeks, down 76% on the four before (17).
- Last 7 days
- 0
- Last 90 days
- 25
- Critical, all time
- 2
- Exploited in the wild
- 2
About Elasticsearch
Elasticsearch is a distributed, RESTful search and analytics engine built on Apache Lucene.
Latest Elasticsearch vulnerabilities
- CVE-2026-115715: Elasticsearch denial of service in phonetic analysis encodersmediumCVSS 6.5
- CVE-2026-115710: Elasticsearch cache information disclosure via field-level security bypassmediumCVSS 4.2
- CVE-2026-115298: Elasticsearch incorrect authorization in field-level securitymediumCVSS 4.3
- CVE-2026-115290: Elasticsearch uncontrolled recursion denial of servicehighCVSS 7.5
- CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster searchhighCVSS 7.1
- CVE-2026-103008: Elasticsearch uncontrolled recursion denial of service in scripted runtime fieldsmediumCVSS 6.5
- CVE-2026-103007: Elasticsearch incorrect authorization in delegated role managementhighCVSS 7.2
- CVE-2026-103006: Elasticsearch uncontrolled recursion in aggregation leading to denial of servicemediumCVSS 6.5
- CVE-2026-103005: Elasticsearch memory exhaustion via oversized connector descriptionmediumCVSS 6.5
- CVE-2026-102411: Elastic Elasticsearch denial of service via unthrottled resource allocationmediumCVSS 6.5
- CVE-2026-102409: Elasticsearch uncontrolled recursion in text chunkingmediumCVSS 6.5
- CVE-2026-102408: Elasticsearch ES|QL CHUNK function denial of service via regular expression exponential blowupmediumCVSS 4.3
- CVE-2026-102407: Elastic Elasticsearch incorrect authorization in data streamsmediumCVSS 5.4
- CVE-2026-102404: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-94408: Elastic Elasticsearch denial of service via resource exhaustionmediumCVSS 4.9
- CVE-2026-94399: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-94398: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-94397: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-94396: Elasticsearch denial of service via uncontrolled resource consumptionmediumCVSS 6.5
- CVE-2026-82300: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-82294: Elasticsearch uncontrolled resource consumption denial of servicemediumCVSS 6.5
- CVE-2026-78607: Elastic Elasticsearch missing authorization in custom inference servicemediumCVSS 5.4EPSS 0.3%
- CVE-2026-78605: Elasticsearch HTTP request smuggling leading to information disclosuremediumCVSS 5.9EPSS 0.3%
- CVE-2026-72649: Elasticsearch machine learning remote code execution via deserializationhighCVSS 8.8EPSS 0.9%
- CVE-2026-56143: Elastic Elasticsearch resource exhaustion denial of servicemediumCVSS 4.9EPSS 0.4%
Most severe Elasticsearch vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2015-1427: Improper Access Control in Elasticsearchcriticalexploited in the wildCVSS 9.8EPSS 99.9%
- CVE-2014-3120: Elasticsearch Improper Access Control vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 88.6%
- CVE-2026-72649: Elasticsearch machine learning remote code execution via deserializationhighCVSS 8.8EPSS 0.9%
- CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inferencehighCVSS 8.8EPSS 0.6%
- CVE-2026-115290: Elasticsearch uncontrolled recursion denial of servicehighCVSS 7.5
- CVE-2026-103007: Elasticsearch incorrect authorization in delegated role managementhighCVSS 7.2
- CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster searchhighCVSS 7.1
- CVE-2025-37731: Elasticsearch PKI realm authentication bypass via crafted client certificatesmediumCVSS 6.8EPSS 0.2%
- CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursionmediumCVSS 6.5EPSS 0.5%
- CVE-2026-72656: Elastic Elasticsearch ES|QL heap exhaustion denial of servicemediumCVSS 6.5EPSS 0.4%
Vulnerabilities per week
4 vulnerabilities in the last four weeks, down 76% on the four before (17). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 4 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 7 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 10 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 4 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Elasticsearch vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/elasticsearch)<a href="https://junglewise.ai/threats/technologies/elasticsearch"><img src="https://junglewise.ai/threats/technologies/elasticsearch/badge.svg" alt="Elasticsearch vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/elasticsearch.json, and this page as text at https://junglewise.ai/threats/technologies/elasticsearch.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Elasticsearch vulnerabilities", https://junglewise.ai/threats/technologies/elasticsearch, 12 November 2026.