CVE-2026-94408

[CVE catalog]

Severity

Medium · CVSS 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated remote attacker with high privileges can cause a Denial of Service (DoS) by triggering excessive resource allocation. Successful exploitation can lead to system resource exhaustion, rendering the service unresponsive or unavailable to legitimate users. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service This vulnerability is rated as Moderate impact because exploitation requires an attacker to possess high administrative privileges, substantially reducing the exposure surface in typical deployments. While a privileged user can exhaust cluster resources and render the service unavailable, the flaw does not facilitate arbitrary code execution or compromise data confidentiality and integrity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.