# Elasticsearch vulnerabilities Source: https://junglewise.ai/threats/technologies/elasticsearch Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/elasticsearch.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in Elasticsearch: 0 in the last 7 days and 25 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-115715, was published on 3 November 2026. 4 vulnerabilities in the last four weeks, down 76% on the four before (17). ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 25 - All time: 45 (2 critical, 2 exploited in the wild) ## About Elasticsearch Elasticsearch is a distributed, RESTful search and analytics engine built on Apache Lucene. ## Latest Elasticsearch vulnerabilities - [CVE-2026-115715: Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-115710: Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in) (medium, CVSS 4.2, published 3 Nov 2026) - [CVE-2026-115298: Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-115290: Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-103008: Elasticsearch uncontrolled recursion denial of service in scripted runtime fields](https://junglewise.ai/threats/cve-2026-103008-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-103007: Elasticsearch incorrect authorization in delegated role management](https://junglewise.ai/threats/cve-2026-103007-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (high, CVSS 7.2, published 6 Oct 2026) - [CVE-2026-103006: Elasticsearch uncontrolled recursion in aggregation leading to denial of service](https://junglewise.ai/threats/cve-2026-103006-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-103005: Elasticsearch memory exhaustion via oversized connector description](https://junglewise.ai/threats/cve-2026-103005-memory-allocation-with-excessive-size-value-cwe-789-in) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-102411: Elastic Elasticsearch denial of service via unthrottled resource allocation](https://junglewise.ai/threats/cve-2026-102411-allocation-of-resources-without-limits-or-throttling-cwe-770-in) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-102409: Elasticsearch uncontrolled recursion in text chunking](https://junglewise.ai/threats/cve-2026-102409-uncontrolled-recursion-cwe-674-in-elasticsearch-can-allow-an) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-102408: Elasticsearch ES|QL CHUNK function denial of service via regular expression exponential blowup](https://junglewise.ai/threats/cve-2026-102408-inefficient-regular-expression-complexity-cwe-1333-in) (medium, CVSS 4.3, published 6 Oct 2026) - [CVE-2026-102407: Elastic Elasticsearch incorrect authorization in data streams](https://junglewise.ai/threats/cve-2026-102407-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (medium, CVSS 5.4, published 6 Oct 2026) - [CVE-2026-102404: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-102404-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-94408: Elastic Elasticsearch denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-94408-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 4.9, published 26 Sep 2026) - [CVE-2026-94399: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-94399-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-94398: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-94398-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-94397: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-94397-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-94396: Elasticsearch denial of service via uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-94396-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-82300: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-82300-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-82294: Elasticsearch uncontrolled resource consumption denial of service](https://junglewise.ai/threats/cve-2026-82294-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-78607: Elastic Elasticsearch missing authorization in custom inference service](https://junglewise.ai/threats/cve-2026-78607-elastic-elasticsearch-missing-authorization-in-custom-inference) (medium, CVSS 5.4, published 1 Sep 2026) - [CVE-2026-78605: Elasticsearch HTTP request smuggling leading to information disclosure](https://junglewise.ai/threats/cve-2026-78605-elasticsearch-http-request-smuggling-leading-to-information) (medium, CVSS 5.9, published 1 Sep 2026) - [CVE-2026-72649: Elasticsearch machine learning remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-72649-elasticsearch-machine-learning-remote-code-execution-via) (high, CVSS 8.8, published 1 Sep 2026) - [CVE-2026-56143: Elastic Elasticsearch resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-56143-elastic-elasticsearch-resource-exhaustion-denial-of-service) (medium, CVSS 4.9, published 1 Sep 2026) ## Most severe Elasticsearch vulnerabilities - [CVE-2015-1427: Improper Access Control in Elasticsearch](https://junglewise.ai/threats/cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution) (critical, exploited in the wild, CVSS 9.8, published 14 May 2022) - [CVE-2014-3120: Elasticsearch Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2014-3120-elasticsearch-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 17 May 2022) - [CVE-2026-72649: Elasticsearch machine learning remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-72649-elasticsearch-machine-learning-remote-code-execution-via) (high, CVSS 8.8, published 1 Sep 2026) - [CVE-2026-72642: Elasticsearch out-of-range pointer offset in machine learning inference](https://junglewise.ai/threats/cve-2026-72642-elasticsearch-out-of-range-pointer-offset-in-machine-learning) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-115290: Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-103007: Elasticsearch incorrect authorization in delegated role management](https://junglewise.ai/threats/cve-2026-103007-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to) (high, CVSS 7.2, published 6 Oct 2026) - [CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2025-37731: Elasticsearch PKI realm authentication bypass via crafted client certificates](https://junglewise.ai/threats/cve-2025-37731-elasticsearch-pki-realm-authentication-bypass-via-crafted-client) (medium, CVSS 6.8, published 15 Dec 2025) - [CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursion](https://junglewise.ai/threats/cve-2024-52980-elastic-elasticsearch-denial-of-service-via-grok-pattern) (medium, CVSS 6.5, published 8 Apr 2025) - [CVE-2026-72656: Elastic Elasticsearch ES|QL heap exhaustion denial of service](https://junglewise.ai/threats/cve-2026-72656-elastic-elasticsearch-es-ql-heap-exhaustion-denial-of-service) (medium, CVSS 6.5, published 13 Aug 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, down 76% on the four before (17). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 7 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 10 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Elastic technologies - [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana): 93 vulnerabilities - [Elastic Cloud Enterprise](https://junglewise.ai/threats/technologies/elastic-cloud-enterprise): 7 vulnerabilities - [Elastic Apm Server](https://junglewise.ai/threats/technologies/apm-server): 4 vulnerabilities - [Elastic Cloud on Kubernetes](https://junglewise.ai/threats/technologies/cloud-on-kubernetes): 4 vulnerabilities - [Elastic Fleet Server](https://junglewise.ai/threats/technologies/fleet-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Elasticsearch vulnerabilities", https://junglewise.ai/threats/technologies/elasticsearch, 12 November 2026.