Elastic published advisory ESA-2026-114 on 1 September. CVE-2026-72649 carries a CVSS 3.1 base score of 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and is a CWE-502 deserialization of untrusted data leading to remote code execution by object injection. The exploit vehicle is the trained machine-learning model artifact itself.
The blast radius is every supported line
Affected versions are 8.0.0 through 8.19.19 and 9.0.0 through 9.4.4, plus 9.5.0 — in practice every 8.x and 9.x release before the fix. Patched releases do exist and are named: 8.19.20, 9.4.5 and 9.5.1. That is worth stating plainly, because of the eleven AI-adjacent CVE records published in this same 24 hours, Elastic's is the only one that tells an operator which version is safe.
What the common framing gets wrong
The reflex on seeing PR:L is “authenticated, so low risk”. That reads wrong here for a specific reason. The privilege required is the ability to deploy a trained model — and in most Elastic deployments that permission is delegated to the data-science team rather than held by cluster administrators, precisely because importing a model from a public hub is treated as a content operation rather than a code operation. The org chart assumes model files are data. This advisory says they are executable.
The workaround is not cheap
The second reflex error is reading the mitigation as a stopgap. Elastic's documented workaround is to set xpack.ml.enabled: false cluster-wide and restart, or to stop importing third-party trained models. Disabling machine learning cluster-wide turns off ELSER, semantic search and anomaly detection — for a large share of clusters, that is the product.
One of roughly nineteen, and the only one at 8.8
Elastic shipped this inside a batch of roughly 19 CVEs across Elasticsearch and Kibana on the same day; the rest run 4.2 to 8.3. A second AI-adjacent entry, CVE-2026-78607 at 5.4, is a missing authorization in the Elasticsearch custom inference service. The 8.8 is the one that matters, and it is easy to lose in a bulk drop.
The supply chain arrives in mainstream infrastructure
Elastic's own documented workflow encourages pulling third-party models in from Hugging Face. The advisory's alternative mitigation is to stop doing that.