Evidence
ES team claims not vulnerable to RCE
As per this statement ES team claims "Elasticsearch is not susceptible to remote code execution with this vulnerability due to our use of the Java Security Manager, however we are making a fix available for an information leakage attack also associated with this vulnerability. Additional details below."