# CVE-2026-115709: Elastic Cloud Enterprise symlink attack via improper link resolution

Source: https://junglewise.ai/threats/cve-2026-115709-improper-link-resolution-before-file-access-link-following-cwe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-115709 · Severity: high · CVSS 8.2 · Published 2026-10-29

Elastic Cloud Enterprise (ECE) is a platform for deploying and managing Elasticsearch clusters. An attacker who can execute code inside an Elasticsearch container—via custom plugins or another vulnerability—can exploit a symlink attack to access data from other deployments running on the same host, causing unauthorized data exposure and loss.

Technologies: [Elastic Cloud Enterprise](https://junglewise.ai/threats/technologies/elastic-cloud-enterprise). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115709 being exploited in the wild.

**How severe is CVE-2026-115709?** High severity, with a CVSS score of 8.2, published 29 October 2026.

**Which products and versions are affected?** Elastic Cloud Enterprise 2.6.0 to 3.8.5, 4.0.0 to 4.2.0.

**Is there a fix for CVE-2026-115709?** Yes: fixed in 3.8.6, 4.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115709 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-115709?** Check whether you run Elastic Cloud Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.6, 4.2.1

## Technical details

A CWE-59 improper link resolution vulnerability in Elastic Cloud Enterprise allows an attacker with code execution inside an Elasticsearch container to perform a symlink attack (CAPEC-132) and read files belonging to other deployments on the same host. The attack requires the attacker to first gain code execution through a plugin, custom bundle, or separate vulnerability. The fix is available in ECE 3.8.6 and 4.2.1 and later.

## Affected products

- Elastic Cloud Enterprise 2.6.0 to 3.8.5, 4.0.0 to 4.2.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263)

## Related threats

- [Elastic Cloud Enterprise symlink attack leads to data access](https://junglewise.ai/threats/cve-2026-115713-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise authorization bypass in platform settings](https://junglewise.ai/threats/cve-2026-115712-incorrect-authorization-cwe-863-in-elastic-cloud-enterprise-ece)
- [Elastic Cloud Enterprise credential exposure in container runtime data](https://junglewise.ai/threats/cve-2026-115711-insertion-of-sensitive-information-into-externally-accessible)
- [Elastic Cloud Enterprise symlink attack authentication bypass](https://junglewise.ai/threats/cve-2026-115708-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise certificate rotation sensitive data exposure](https://junglewise.ai/threats/cve-2026-115707-insertion-of-sensitive-information-into-externally-accessible)