DeutschShown in its original language — a full translation is planned for a future version.
Elasticsearch: Mehrere Schwachstellen
view advisory published 2026-09-01
Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-78607US | high7.1OT elevated | — | ||
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference exec… | ||||
| CVE-2026-78605US | — | — | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under s… | ||||
| CVE-2026-72649US | — | — | ||
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted… | ||||
| CVE-2026-56143US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privilege… | ||||
02
references
External citations — patches, advisories, analysis.
- Microsoft Security Update Guide vom 2026-09-08external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- WID-SEC-W-2026-3131 - CSAF Versionself
- WID-SEC-2026-3131 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan