Detections
Analytics
Elasticsearch 8.19.x < 8.19.20 / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-80 / ESA-2026-123)
high Nessus Plugin ID 338339
Language:
Synopsis
The remote host is missing a security update.Description
The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-80 and ESA-2026-123 advisories.- The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. (CVE-2026-72642)
- Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. (CVE-2026-72678)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Elasticsearch version 8.19.20, 9.4.5, or 9.5.1 or later as appropriate for your release branch.See Also
Plugin Details
Severity: High
ID: 338339
File Name: elasticsearch_ESA-2026-80.nasl
Version: 1.2
Type: Combined
Agent: unix
Family: Misc.
Published: 8/20/2026
Updated: 8/21/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.82
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-72642
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:elastic:elasticsearch, cpe:/a:elasticsearch:elasticsearch
Required KB Items: installed_sw/Elasticsearch
Exploit Ease: No known exploits are available
Patch Publication Date: 8/13/2026
Vulnerability Publication Date: 8/13/2026
Reference Information
CVE: CVE-2026-72642, CVE-2026-72678