Elasticsearch EUVD-2026-69562

Exploitation requires a valid Elasticsearch session authenticated with the machine_learning_admin role, or a custom role granting the cluster:admin/xpack/ml/trained_models/put privilege (or equivalent trained-model write access). The ML feature must be enabled on the cluster (xpack.ml.enabled: true, which is the default in licensed Elasticsearch subscriptions including Elastic Cloud). Standard Elasticsearch roles such as read, viewer, kibana_user, or ingest-only roles do not grant the necessary privileges and cannot trigger this vulnerability. Exploitation is also limited to deployments on the licensed Elastic Stack (Basic license tier and above); trial and free-tier configurations with ML disabled are not affected. The attacker must be able to reach the Elasticsearch REST API (typically TCP/9200 or TCP/9243 on Elastic Cloud).

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the network-accessible attack surface and full CIA impact, but PR:L warrants careful interpretation: exploitation requires not merely any authenticated Elasticsearch user, but one holding the machine_learning_admin role or an equivalent custom role with trained-model write permissions - a meaningfully narrowed attacker pool compared to generic PR:L. In practice, ML model deployment rights are granted to data-science pipelines and MLOps service accounts, expanding the risk to credential compromise or insider threat vectors. No EPSS score was provided in the input; KEV status is absent, and no public exploit has been identified, which lowers the immediate exploitation probability. However, Elasticsearch is widely deployed in enterprise analytics and AI/ML infrastructure, and the full host-level code execution impact (C:H/I:H/A:H) means a successful exploit on a multi-tenant or cloud-hosted cluster carries significant blast radius. The AC:L rating reflects that, once proper credentials are in hand, the exploit path - upload crafted artifact, deploy model, trigger deserialization - is straightforward with no race conditions or environmental guesswork required.

An attacker who has compromised an MLOps service account holding the machine_learning_admin role, or an insider with model deployment rights, crafts a malicious serialized Java object payload embedded within a model artifact and uploads it via PUT /_ml/trained_models/{model_id}. Upon deploying the model to an inference endpoint, the Elasticsearch ML subsystem deserializes the artifact, triggering attacker-controlled code execution within the Elasticsearch JVM process with broad host system-call access - potentially enabling full node compromise, lateral movement within the cluster, or exfiltration of indexed data. No public exploit code has been identified at time of analysis.