CVSS 8.2 (high) · published 2026-10-29
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
Affected products (NVD): elastic elastic_cloud_enterprise
Fixed in (NVD): 3.8.6, 4.2.1
Weakness: CWE-59
Source: NVD CVE-2026-115709
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.