Elasticsearch Remote Code Execution Vulnerability

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

Published 7 Oct 2026Updated 7 Oct 2026415 sources

CVSS 8.1 ✓ VERIFIED REFERENCE△ CISA KEV

Overview Sources History

What happened

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

Affected versions

Elasticsearch: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

Exploit-DB 33588ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit)Metasploit2014-05-30Verified Exploit-DB 33370ElasticSearch - Remote Code ExecutionJeff Geiger2014-05-15Verified PoC-in-GitHub · jeffgeiger/es_injectDemonstration of CVE-2014-3120★ 0jeffgeiger2014-05-13Candidate PoC-in-GitHub · echohtp/ElasticSearch-CVE-2014-3120POC Code to exploite CVE-2014-3120★ 6echohtp2014-07-07Candidate PoC-in-GitHub · xpgdgit/CVE-2014-3120★ 0xpgdgit2022-08-01Candidate PoC-in-GitHub · Dungsocool/CVE-2014-3120★ 0Dungsocool2026-05-31Candidate PoC-in-GitHub · CyberCTF/vulhub-elasticsearch-cve-2014-3120Vulhub elasticsearch/CVE-2014-3120: Elasticsearch MVEL Dynamic Script RCE (CVE-2014-3120), run with Isoloom★ 0CyberCTF2026-10-08Candidate SploitusExploit for CVE-2014-3120. CVSS 8.1.Sploitus index2026-10-16T00:48:28+00:00Candidate

Corrections Report an issue