What is the CVSS score of EUVD-2026-58287?

EUVD-2026-58287 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Elasticsearch are affected by EUVD-2026-58287?

Elasticsearch deployments with machine learning features enabled face remote code execution risk (CVE-2026-72642, CVSS 8.8) when model management permissions are held by non-administrative users.

How to fix or mitigate EUVD-2026-58287?

Within 24 hours, audit all Elasticsearch deployments to identify systems with ML features enabled and document which user accounts hold ML model upload or deploy permissions. Within 7 days, immediately revoke ML model management permissions from all non-administrative users and restrict these capabilities exclusively to required administrators; implement network segmentation to isolate Elasticsearch ML inference subprocess communications where possible. Within 30 days, establish ongoing monitoring for vendor security patches (checking Elasticsearch security advisories for CVE-2026-72642), and develop a formal change control process for ML permission re-evaluation based on verified business requirements.

Elasticsearch EUVD-2026-58287

| CVE-2026-72642 HIGH

Use of Out-of-range Pointer Offset (CWE-823)

2026-08-13 elastic

GHSA-2rm9-5cpg-f943

RCE Memory Corruption Elastic Elasticsearch

8.8

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable REST API attack vector, low-privilege ML role required with no complexity or interaction, and full CIA impact confined within the inference subprocess scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:58 vuln.today

CVE Published

Aug 13, 2026 - 19:13 cve.org

HIGH 8.8

DescriptionCVE.org

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.

AnalysisAI

Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by any user holding the low-privilege ML model upload and deploy permission. By crafting a model that embeds an operation computing a memory address from an attacker-controlled offset, a low-privileged authenticated user can cause the native inference subprocess to read and write outside its allocated heap, reliably crashing that process or, under controlled heap layout conditions, executing arbitrary code within it. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS 8.8 rating, network-accessible vector, and explicit RCE potential in the vendor description place this in the urgent-remediation tier for any organization running Elasticsearch with ML features delegated to non-admin users.

Technical ContextAI

CWE-823 (Use of Out-of-range Pointer Offset) covers the vulnerability class where a program computes a runtime pointer by adding an untrusted, unvalidated numeric offset to a base address, potentially referencing memory well outside the intended allocation. Elasticsearch's machine learning feature exposes a REST API for uploading and deploying trained models, which are then executed by a native (C/C++) inference subprocess separate from the main JVM-based Elasticsearch process. This native layer processes model graph operations, and at least one operation type computes a runtime memory address by applying an offset value embedded directly in the model file. Because the inference engine performs no bounds check comparing this offset against the size of the underlying allocation before dereferencing the resulting pointer, a specially crafted model can direct arbitrary reads and writes anywhere on the process heap. The affected product is identified by CPE cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*, covering all tracked Elasticsearch versions published by Elastic.

RemediationAI

Upgrade Elasticsearch to a patched release as indicated by the vendor advisory ESA-2026-123: version 8.19.20 or later for 8.x deployments, 9.4.5 or later for the 9.4.x branch, or 9.5.1 or later for the 9.5.x branch (https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504). If an immediate upgrade is not possible, the most targeted compensating control is to audit and revoke the manage_ml or equivalent ML admin cluster privilege from all non-essential user accounts, since removing this privilege entirely eliminates the attack surface at the cost of requiring all model deployments to be performed by a highly trusted administrator. A stronger isolation measure is to disable the ML subsystem cluster-wide by setting xpack.ml.enabled: false in the Elasticsearch configuration, which removes all ML inference capability as a trade-off. Network-layer ACLs restricting access to the Elasticsearch API port do not mitigate this vulnerability for users who already hold valid credentials and API access.