CVE-2015-1427

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · weaponizedDEEUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 9 exploits · weaponized

Likely / severe?

99.9% (100th) EPSS

CVSS 7.5 · high

Is it mine?

13 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

added 2022-03-25remediate by 2022-04-15

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

exploits (9)

Public proof-of-concept and weaponised exploit code.

exploit/multi/elasticsearch/search_groovy_scriptElasticSearch Search Groovy Sandbox Bypassweaponized · metasploit
EDB-36337ElasticSearch - Remote Code Executionfunctional · exploit_db
EDB-36415ElasticSearch - Search Groovy Sandbox Bypass (Metasploit)functional · exploit_db
CyberCTF/vulhub-elasticsearch-cve-2015-1427Vulhub elasticsearch/CVE-2015-1427: Elasticsearch 1.4.2 Groovy sandbox escape, run with IsoloomPoC · poc_in_github
Sebikea/CVE-2015-1427-for-trixieTo test elasticsearch vulnerabillity on newer version of debianPoC · poc_in_github
cved-sources/cve-2015-1427cve-2015-1427PoC · poc_in_github

affected products (13)

Products and version ranges known to be affected.

Juniper Junos Space Security Director <24.1R4all versionscert_bundDE
Open Source Elasticsearch <1.3.8all versionscert_bundDE
Open Source Elasticsearch <1.4.3all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Juniper Junos Space≤ Security Director <24.1R4cert_bundDE
Open Source Elasticsearch< 1.3.8cert_bundDE
Open Source Elasticsearch< 1.4.3cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
elastic elasticsearch< 1.3.8nvdUScpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
elastic elasticsearch1.4.0 → 1.4.3nvdUScpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
redhat fuse= 1.0.0nvdUScpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:*
Maven org.elasticsearch:elasticsearch< 1.3.8osvUSpkg:maven/org.elasticsearch/elasticsearch
Maven org.elasticsearch:elasticsearch1.4.0 → 1.4.3osvUSpkg:maven/org.elasticsearch/elasticsearch

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2233Elasticsearch: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des DienstesDeutsch2015-02-11csaf · cert_bundDE
Ein entfernter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
GHSA-w94p-6mhw-4qxwImproper Access Control in Elasticsearch2022-05-14ghsa · osvUS
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2015-02-17modified 2026-06-17

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan