CVE-2026-63140

Assessment

Why it matters

EPSS is 0.2%; technical severity is CVSS 6.5.

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.

Who should care

• Teams operating Elasticsearch
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Elasticsearch is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from discuss.elastic.co
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-617

Affected versions

Elastic Elasticsearch (Start Including 8.0.0, End Excluding 8.19.19 | Start Including 9.0.0, End Excluding 9.3.8 | Start Including 9.4.0, End Excluding 9.4.4)

Fixed versions

Elastic Elasticsearch (Fixed from 8.19.19, 9.3.8, 9.4.4)

Published

21 July 2026

Attack vector

Network

Privileges required

Low

User interaction

None

Signal timeline

1. 21 Jul 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.2%
3. 19 Aug 2026 · 13:54 UTCSignal calculated at 11

External references

• Discuss Elastic Co Technical reference 388565 ↗