Elastic Cloud Enterprise: Improper link resolution vulnerability (CVE-2026-115709)
Elastic Cloud Enterprise (ECE) contains a vulnerability (CWE-59) that can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
CVE search metadata
CVE search record: CVE-2026-115709. Severity: high. CVSS: 8.2. KEV: no. Product: Elastic Cloud Enterprise. Brief: Elastic Cloud Enterprise: Improper link resolution vulnerability (CVE-2026-115709). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ece-symlink-vulnerability/
Triage facts
Revision 1- Applicability
- Elastic Cloud Enterprise
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 15:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Elastic Cloud Enterprise (ECE) is affected by an improper link resolution flaw (CWE-59). This vulnerability allows for a Symlink Attack (CAPEC-132), which can lead to the unauthorized disclosure and loss of data belonging to other deployments on the same host.
Impact
Successful exploitation may result in the unauthorized disclosure and loss of data across different deployments residing on the same host infrastructure.