Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2015-1427

99
FAUCET Score

CVE-2015-1427 is a critical vulnerability affecting Elasticsearch versions before 1.3.8 and 1.4.3, as well as related products from Elastic and Red Hat. It allows remote attackers to bypass the Groovy scripting engine's sandbox and execute arbitrary shell commands. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network without authentication or user interaction, leading to complete compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, with public exploit modules available in Metasploit and Nuclei, and has garnered significant community discussion and media coverage, including its use by botnets and ransomware.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.3.8CPE matchmatch criteria
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
>= 1.4.0, < 1.4.3CPE matchmatch criteria
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
1.0.0CPE matchmatch criteria
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
99.91%
Probability of exploitation in next 30 days
EPSS Percentile
100.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
Added to KEV · Mar 25, 2022
Metasploit: ElasticSearch Search Groovy Sandbox Bypass · Feb 11, 2015
Nuclei: CVE-2015-1427 · Feb 15, 2021
ExploitDB: EDB-36415 · Mar 16, 2015
This CVE's current EPSS score of 0.9991 is in the 100th percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

mavenpatch availablevia ghsa
Product: org.elasticsearch:elasticsearchFixed in: 1.3.8
mavenpatch availablevia ghsa
Product: org.elasticsearch:elasticsearchFixed in: 1.4.3

Vendor Advisories (1)

mavenGHSA-w94p-6mhw-4qxwhigh

Improper Access Control in Elasticsearch

May 14, 2022

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
packetstormsecurity.com / files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
Third Party AdvisoryVDB Entry
packetstormsecurity.com / files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
ExploitThird Party AdvisoryVDB Entry
access.redhat.com / errata/RHSA-2017:0868
Third Party Advisory
exchange.xforce.ibmcloud.com / vulnerabilities/100850
Third Party AdvisoryVDB Entry
elastic.co / community/security
Not ApplicableVendor Advisory
elasticsearch.com / blog/elasticsearch-1-4-3-1-3-8-released
PatchVendor Advisory
securityfocus.com / archive/1/534689/100/0/threaded
Broken LinkThird Party AdvisoryVDB Entry
securityfocus.com / bid/72585
Broken LinkThird Party AdvisoryVDB Entry