---
id: "CVE-2015-1427"
kind: "vulnerability"
aliases: ["CVE-2015-1427"]
title: "Elastic Elasticsearch: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99906
exploited: true
status: "open"
category: "package"
products: [{"name": "Elastic Elasticsearch", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Elasticsearch", "fixed": ["1.3.8", "1.4.3"], "affected": ">= 1.3.0, <= 1.3.7; >= 1.4.0, <= 1.4.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["elasticsearch", "exploited", "groovy", "package", "rce", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2015-02-17T15:59:04+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1427", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1427", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:24:40+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1427", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Elastic Elasticsearch: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

Elasticsearch 1.3.0-1.3.7 and 1.4.0-1.4.2 let a crafted Groovy script escape the sandbox and run shell commands as the Elasticsearch JVM user. Fixed in 1.3.8 and 1.4.3, which turn off dynamic Groovy scripting by default. Only very old 1.x clusters are affected; 1.5 and later are not listed as affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Elastic Elasticsearch affected ? fixed ?
- vendor:Elasticsearch affected >= 1.3.0, <= 1.3.7; >= 1.4.0, <= 1.4.2 fixed 1.3.8, 1.4.3

## How to check

Run GET / on the node to read version.number: 1.3.0-1.3.7 or 1.4.0-1.4.2 is affected. Then check config/elasticsearch.yml for script.groovy.sandbox.enabled: true or the old default of dynamic scripting on. Reachable port 9200 makes it remotely exploitable.

## Fix

Upgrade to 1.3.8 or 1.4.3 or later. If you cannot upgrade, set script.groovy.sandbox.enabled: false in config/elasticsearch.yml and restart the node. Move trusted Groovy scripts to config/scripts on disk. Do not expose port 9200 to untrusted networks.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1427
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-1427
- 2026-10-23T21:24:40+00:00 analyst — Read Elastic's advisory (Bugtraq copy) and the GitHub fix issue; fixed 1.3.8 and 1.4.3. Elastic's blog URL did not return the post; no PoC page read, exploitation per CISA KEV.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-1427

## Documents

- [advisory] Elasticsearch vulnerability CVE-2015-1427 (Elastic, Bugtraq) https://seclists.org/bugtraq/2015/Feb/92
- [describes] GitLab Advisory DB CVE-2015-1427 https://advisories.gitlab.com/maven/org.elasticsearch/elasticsearch/CVE-2015-1427/
- [fix] Disable dynamic Groovy scripting by marking Groovy as not sandboxed https://github.com/elastic/elasticsearch/issues/9655

## From the sources

The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_