{"id":"CVE-2026-115709","aliases":[],"cve":{"records":[{"id":"CVE-2026-115709","source":"elastic","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T11:09:48.309Z","published":"2026-10-29T14:10:03.402Z","modified":"2026-10-30T17:18:28.637Z"}],"publishers":[{"name":"elastic","role":"CNA","organizationId":"271b6943-45a9-4f3a-ab4e-976f3fa05b5a","modified":"2026-10-29T14:10:03.402Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:28.637Z"}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","tags":[],"source":"elastic"}],"weaknesses":[{"id":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')","source":"elastic"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T03:56:13.037915Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss","titleSource":"elastic","descriptionSource":"elastic","description":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).","score":8.2,"severity":"high","published":"2026-10-29T14:10:03.402Z","modified":"2026-10-30T17:18:28.637Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Elastic","name":"Elastic Cloud Enterprise","platforms":[],"versions":[{"version":"2.6.0","status":"affected","lessThanOrEqual":"3.8.5","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThanOrEqual":"4.2.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"elastic","url":"https://www.cve.org/CVERecord?id=CVE-2026-115709"}],"remediation":[],"references":["https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263"],"sources":[{"name":"CVE","id":"CVE-2026-115709","modified":"2026-10-30T17:18:28.637Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115709"}],"assessments":[{"source":"elastic","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":8.2}],"sourceAffected":[],"observedAt":"2026-10-30T19:26:31.366Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T05:00:36.500Z","attemptedAt":"2026-10-30T05:00:36.500Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T05:00:35.300Z","attemptedAt":"2026-10-30T05:00:35.300Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T05:00:34.170Z","attemptedAt":"2026-10-30T05:00:34.170Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T05:00:33.428Z","attemptedAt":"2026-10-30T05:00:33.428Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-112922","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112922","modified":"Oct 29, 2026, 2:10:03 PM","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T05:00:34.170Z"},{"source":"GitHub Advisory Database","id":"GHSA-h35v-mg7c-5q9x","url":"https://github.com/advisories/GHSA-h35v-mg7c-5q9x","modified":"2026-10-29T15:31:03Z","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T05:00:35.300Z"},{"source":"NVD","id":"CVE-2026-115709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115709","modified":"2026-10-30T04:18:18.233","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T05:00:36.500Z"}],"aiSummary":{"text":"Elastic Cloud Enterprise (ECE) versions 2.6.0 to 3.8.5 and 4.0.0 to 4.2.0 have an improper link resolution weakness, potentially leading to information disclosure and data loss. An attacker with access can exploit this via a Symlink Attack. The impact is unauthorized disclosure and loss of data belonging to other deployments on the same host.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:09:51.967Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115709"}]}}