Elasticsearch EUVD-2026-116072

Exploitation requires network reachability to a node's remote cluster/server interface; the attacker then sends a specially crafted request carrying a serialized payload with nested structures (CAPEC-230) that drives uncontrolled recursion and terminates the node. No credentials, user interaction, or special feature toggles are stated as required - per the description this works unauthenticated against reachable nodes. The practical limiting factor is network exposure of the node interface: deployments that restrict access to the transport/cluster interface via network segmentation, firewalls, or non-exposed binding reduce reachability, whereas clusters whose node interfaces are broadly reachable are exposed by default, and the attack scales by repeating the request against every reachable node.

This is a credible operational priority but not a maximum-urgency emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: a remote, unauthenticated, low-complexity request against a reachable node causes termination, with availability-only impact and no confidentiality or integrity loss. The vuln.today decision label is 'this_week', which aligns with a high-availability-impact DoS that is not yet tied to active exploitation. No EPSS probability, no CISA KEV listing, and no public exploit were provided, so the signals are concordant rather than conflicting - all point to a real but availability-limited risk rather than a compromise-grade flaw. The description states the request can be repeated against each reachable node, so an attacker with network reach can degrade or take down an entire cluster, which raises real-world impact for internet-exposed or flat-network deployments even though confidentiality and integrity are untouched. Missing data to note explicitly: EPSS, KEV, and PoC status are all absent from the input, so widespread-exploitation likelihood cannot be quantified, and exact fixed versions are not reliably parseable from the single advisory URL.

An attacker with network access to a node's cluster/server interface sends a specially crafted request containing a serialized payload with deeply nested structures, triggering uncontrolled recursion that exhausts the stack and terminates the node process. Because no credentials are required and complexity is low, the attacker simply repeats the request against each reachable node to knock out the cluster. No public exploit was identified in the provided data.