cyfenced.com →

[ CVE-2026-115708 · Published 29 Oct 2026 ]

Vulnerability in Elastic Cloud Enterprise

CVSS 7.2 EPSS <1%1 agency advisoryFix available

[ Description ]Official description

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

[ Fixes ]Fixes and patches

  • Security bulletin: Elastic 391263Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391264Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391261Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391262Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391260Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391265Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-secu, cited by CERT-FR CERTFR-2026-AVI-1419
  • Security bulletin: Elastic 391266Vendor patch or bulletin · CERT-FR · discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-updat, cited by CERT-FR CERTFR-2026-AVI-1419

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1419

    Multiple vulnerabilities in Elastic Cloud Enterprise Translated from French

    Multiple vulnerabilities have been discovered in Elastic Cloud Enterprise. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and a breach of data integrity.

    CVE-2026-115707CVE-2026-115713CVE-2026-115712+4 more CVEs

[ References ]References