Elasticsearch CVE-2026-72685

Exploitation requires a valid Elasticsearch account with document indexing privileges (index:data/write/* or equivalent) on at least one accessible index. The attacker must be able to reach the Elasticsearch HTTP or HTTPS API endpoint over the network (default port 9200 or 9243). No administrative or cluster-management privileges are required. Exploitation is strictly limited to availability degradation of the targeted node's indexing thread pool - no confidentiality or integrity compromise is possible per the CVSS vector (C:N/I:N). Limiting factors include: (1) authentication is required, ruling out unauthenticated network attackers; (2) impact is scoped to a single node's indexing throughput, not the full cluster or search/read paths; (3) multi-node clusters may absorb or redistribute the availability impact. The specific document field or ingest processor component vulnerable to worst-case complexity is not identified in publicly available data, meaning exploitation may require trial-and-error against a live target.

The CVSS 4.3 Medium score appropriately reflects a bounded, partial availability impact rather than a total denial-of-service. Key CVSS signals: network-accessible (AV:N), low complexity (AC:L), low privilege required (PR:L), and low availability impact (A:L). EPSS data was not provided, limiting probabilistic exploitation probability assessment. No CISA KEV listing and no public proof-of-concept code exist at time of analysis, making active exploitation unlikely in the near term. Real-world risk is most relevant in multi-tenant or SaaS Elasticsearch deployments where untrusted or minimally-vetted users hold indexing credentials - in such environments, a single account can sustainably degrade a node's indexing throughput. In homogeneous enterprise deployments with tightly controlled credential issuance, the practical risk is substantially lower. The 'Information Disclosure' tag present in the source intelligence is inconsistent with both the CVE description and the CVSS vector (C:N/I:N) and should be treated as erroneous metadata. The cluster-level blast radius is also bounded: multi-node Elasticsearch clusters may continue serving read and search traffic normally even when one node's indexing threads are saturated.

An attacker holding a low-privileged Elasticsearch account with write access to any index crafts a small JSON document whose field values contain patterns that trigger worst-case complexity in a vulnerable analyzer or ingest processor. By repeatedly submitting such documents via the standard indexing API, the attacker keeps worker threads in the bounded thread pool occupied far longer than normal, degrading the node's ability to process legitimate indexing requests from other users. No elevated privileges, special tooling, or knowledge of internal cluster topology is required beyond valid indexing credentials.