How severe is CVE-2015-1427?

CVE-2015-1427 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2015-1427 being actively exploited?

Yes. CVE-2015-1427 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2015-1427?

CVE-2015-1427 primarily affects Elastic Elasticsearch. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-1427?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2015-1427 have an EU (EUVD) identifier?

Yes. CVE-2015-1427 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-5539. It is also flagged as exploited in the EUVD (since 2022-03-25).

When was CVE-2015-1427 published?

CVE-2015-1427 was published on 2015-02-17 and last updated on 2026-06-17.

CVE-2015-1427

CVE-2015-1427 is a critical-severity vulnerability in Elastic Elasticsearch with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-03-25).

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 100% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2022-03-25)
EU (EUVD) id: EUVD-2022-5539
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-03-25)
Affected product: Elastic Elasticsearch
Published: 2015-02-17
Last modified: 2026-06-17

Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Frequently asked questions

What is CVE-2015-1427?: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
How severe is CVE-2015-1427?: CVE-2015-1427 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2015-1427 being actively exploited?: Yes. CVE-2015-1427 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2015-1427?: CVE-2015-1427 primarily affects Elastic Elasticsearch. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-1427?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2015-1427 have an EU (EUVD) identifier?: Yes. CVE-2015-1427 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-5539. It is also flagged as exploited in the EUVD (since 2022-03-25).
When was CVE-2015-1427 published?: CVE-2015-1427 was published on 2015-02-17 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*

More vulnerabilities in Elastic Elasticsearch

CVE-2015-5377 — Critical (CVSS 9.8): Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the…
CVE-2020-7014 — High (CVSS 8.8): The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1…
CVE-2020-7009 — High (CVSS 8.8): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an…
CVE-2018-3831 — High (CVSS 8.8): Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when…
CVE-2019-7611 — High (CVSS 8.1): A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document…
CVE-2014-3120 — High (CVSS 8.1): The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to…

All CVEs affecting Elastic Elasticsearch →