CVE-2026-115713

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Elastic	Elastic Cloud Enterprise	>= 4.1.0, <= 4.2.0

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1157147.4Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, CVE-2026-1157156.5Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input CVE-2026-1157166.5Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Pay CVE-2026-1157177.7Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks t CVE-2026-1157184.3Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any au CVE-2026-115728.8Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of CVE-2026-1157205.0Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard CVE-2026-1157217.5**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. CVE-2026-1157226.1RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list prope CVE-2026-1157237.4Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow CVE-2026-1157242.9VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based on CVE-2026-1157254.2Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by suppl