Improper Link Resolution in Elastic Cloud Enterprise by Elastic
CVE-2026-115709

8.2HIGH

Key Information:

Vendor

Elastic
Status
Elastic Cloud Enterprise
Vendor
CVE Published:
29 October 2026

What is CVE-2026-115709?

A vulnerability in Elastic Cloud Enterprise (ECE) allows for improper link resolution before file access, resulting in potential unauthorized disclosure and data loss from different deployments sharing the same host. This issue arises due to a flaw in how ECE handles symlink attacks, putting sensitive information at risk.

Affected Version(s)

Elastic Cloud Enterprise 2.6.0 <= 3.8.5

Elastic Cloud Enterprise 4.0.0 <= 4.2.0

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.