Elasticsearch EUVD-2026-87802

Requires an authenticated high-privilege Elasticsearch account (CVSS PR:H) with network access to the cluster API; exploitation is network-reachable (AV:N) with low complexity (AC:L) and no user interaction. The description does not identify the specific endpoint, query type, or configuration that triggers the excessive allocation, so the concrete trigger is unspecified. The high-privilege prerequisite is the primary limiting factor, confining realistic risk to malicious insiders or attackers who have already obtained privileged credentials; impact is limited to availability (node/cluster resource exhaustion) with no confidentiality or integrity effect.

This is a genuinely low-priority issue despite being a network-reachable DoS. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9) reports HIGH privileges required, meaning the attacker must already hold a privileged Elasticsearch account before triggering the excessive-allocation flaw - a substantial gate that limits exposure to insiders or already-compromised admin credentials. Impact is availability-only (C:N/I:N/A:H): no data exposure or integrity loss, just resource exhaustion / node degradation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All signals align consistently - moderate-low CVSS, no exploitation evidence, high privilege barrier - so there is no CVSS-vs-reality conflict here; this is a real-but-minor availability bug, not a high-severity emergency. Note the description does not name the specific request path or feature that acts as the allocation sink, which limits precise mitigation guidance beyond patching. This is the higher-privilege sibling of related Elasticsearch DoS CVEs (e.g. CVE-2026-94396/94397) which required only low privileges and scored 6.5.

An attacker who already holds a high-privilege Elasticsearch account (or has compromised such credentials) sends a crafted API request that forces the server to allocate an excessive amount of memory/resources, exhausting the node and degrading or denying service to legitimate clients. No public exploit code is identified, and the requirement for high privileges makes opportunistic mass exploitation unlikely.