Elastic Cloud Enterprise CVE-2026-115707

Exploitation requires that (1) the attacker already controls at least one host in the ECE installation, and (2) the ECE certificate rotation procedure has been run, after which the retained rotation data containing platform credentials and certificate authority private keys becomes readable by lower-privileged platform components. These are the concrete prerequisites that limit real-world exploitation: this is not remotely reachable without a prior foothold on an installation host, the sensitive data only exists once the certificate rotation procedure has executed, and the CVSS metrics indicate adjacent-network reach with high privileges required (PR:H). Per CVSS, this is an authenticated/privileged scenario, not unauthenticated remote access. The only complete remediation stated by the vendor is upgrading to ECE 3.8.6 or 4.2.1.

This is a moderate-severity but high-impact privilege escalation in Elastic Cloud Enterprise, scored CVSS 6.4 (AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). The modest base score is driven almost entirely by the difficulty of reaching the flaw - adjacent vector, high attack complexity, and high privileges required - rather than by low consequences: the technical impact is total (C:H/I:H/A:H), yielding full control of the ECE control plane and every managed deployment. The decision signals are mixed: vuln.today assigns a 'this_month' priority (not act_now/emergency), there is no CISA KEV listing and no EPSS value supplied, and no public exploit or PoC reference is present, so there is no public exploit identified at time of analysis. The practical gate is the prerequisite that the attacker already controls a host within the installation and that the ECE certificate rotation procedure has been run, leaving credentials and CA private keys readable by lower-privileged components - so this is a post-compromise escalation and blast-radius amplifier rather than an initial-access or wormable issue. No EPSS score and no SSVC automatable/exploitation fields were provided in the input, so widespread-exploitation likelihood cannot be quantified from the data; treat the 'this_month' label plus the catastrophic impact-if-reached as the basis for prioritized but non-emergency patching.

An attacker who has already gained control of any single host in an ECE installation (for example via a lower-privileged platform component) reads the data retained after the certificate rotation procedure, recovering platform credentials and certificate authority private keys. Using those secrets they authenticate to and take over the ECE control plane, gaining full control over all deployments it manages. No public exploit code or PoC reference is identified in the available data.