CVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code exec

Elasticsearch's machine learning component has a vulnerability where it unsafely processes untrusted data during deserialization (the conversion of saved data back into usable objects), allowing attackers to inject and execute malicious code through specially crafted trained models. An attacker would need valid authentication and permissions to create and deploy models to exploit this flaw.