CVE-2026-92468 zlt2000 CVE debrief

Who should care

Defenders responsible for systems using the zlt2000 microservices-platform, especially version 6.0.0 or earlier, should assess their exposure and implement compensating controls to restrict access to Elasticsearch indices.

Why it matters

The CVE-2026-92468 vulnerability in the zlt2000 microservices-platform allows authenticated attackers to read any Elasticsearch index, potentially exposing sensitive user records and password hashes. Defenders should prioritize verifying the presence of this vulnerability in their systems and implement compensating controls to restrict access to Elasticsearch indices.

• Potential exposure of sensitive user records and password hashes
• Possible unauthorized access to Elasticsearch indices
• Need for verification of affected versions and systems
• Requirement for compensating controls to restrict access

Technical summary

The zlt2000 microservices-platform through version 6.0.0 contains an authorization bypass vulnerability in the search-center service. This vulnerability allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices, including sys_user, to retrieve sensitive user records and password hashes without proper access controls.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they use the affected microservices-platform version 6.0.0 or earlier, and implement compensating controls to restrict access to Elasticsearch indices.

Recommended defensive actions

• Verify the presence of the vulnerability in the microservices-platform version 6.0.0 or earlier
• Implement compensating controls to restrict access to Elasticsearch indices
• Monitor for potential exploitation attempts
• Review and update access controls for the search-center service
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity. However, the exact scope of affected versions and systems requires further verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.