Improper Link Resolution in Elastic Cloud Enterprise by Elastic
CVE-2026-115708

7.2HIGH

Key Information:

Vendor

Elastic
Status
Elastic Cloud Enterprise
Vendor
CVE Published:
29 October 2026

What is CVE-2026-115708?

A security vulnerability in Elastic Cloud Enterprise (ECE) allows for improper link resolution before file access, enabling attackers to perform symlink attacks. This can lead to authentication bypass and unauthorized configuration modifications in deployments sharing the same host. The exploitation of this vulnerability poses significant security risks to cloud management environments, necessitating immediate updates and protective measures.

Affected Version(s)

Elastic Cloud Enterprise 1.0.0 <= 3.8.5

Elastic Cloud Enterprise 4.0.0 <= 4.2.0

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.