diff --git a/distribution/tools/ansi-console/src/main/java/org/elasticsearch/io/ansi/AnsiConsoleLoader.java b/distribution/tools/ansi-console/src/main/java/org/elasticsearch/io/ansi/AnsiConsoleLoader.java
index 81914e344e60..427978d3ec3e 100644
--- a/distribution/tools/ansi-console/src/main/java/org/elasticsearch/io/ansi/AnsiConsoleLoader.java
+++ b/distribution/tools/ansi-console/src/main/java/org/elasticsearch/io/ansi/AnsiConsoleLoader.java
@@ -40,7 +40,11 @@ public ConsoleLoader.Console get() {
     // package-private for tests
     static @Nullable ConsoleLoader.Console newConsole(AnsiPrintStream out) {
         if (isValidConsole(out)) {
-            return new ConsoleLoader.Console(out, () -> out.getTerminalWidth(), Ansi.isEnabled(), tryExtractPrintCharset(out));
+            // virtual terminal does support ANSI escape sequences, but the JVM must toggle a mode
+            // option on the console using the Kernel32 API, which JANSI knows to do, but ES currently lacks
+            // the testing infra to assert the behavior
+            boolean ansiEnabled = Ansi.isEnabled() && out.getType() != AnsiType.VirtualTerminal;
+            return new ConsoleLoader.Console(out, () -> out.getTerminalWidth(), ansiEnabled, tryExtractPrintCharset(out));
         } else {
             return null;
         }
diff --git a/docs/changelog/83326.yaml b/docs/changelog/83326.yaml
new file mode 100644
index 000000000000..74523227a1b6
--- /dev/null
+++ b/docs/changelog/83326.yaml
@@ -0,0 +1,5 @@
+pr: 83326
+summary: Disable ANSI formatting for security autoconfiguration on Windows cmd line
+area: Security
+type: bug
+issues: []