Elastic Cloud Enterprise EUVD-2026-112921

Exploitation requires local access to the ECE host (AV:L) with high privileges already held (PR:H), in a multi-tenant configuration where multiple deployments are co-located on the same host - the attack abuses ECE's improper resolution of a symbolic link to reach another deployment's files. Limiting factors that reduce realistic risk: the attacker must be local and already highly privileged, no remote or unauthenticated path exists, and the high attack complexity (AC:H) indicates non-trivial, possibly race- or condition-dependent setup that is not fully described in the available sources. The complete fix is upgrading to ECE 3.8.6 or 4.2.1 as stated by the vendor.

This is a genuine but constrained risk. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, base 7.2 HIGH) describes a locally-exploitable flaw that already requires high privileges and a hard-to-win set of conditions (AC:H), but which, once triggered, breaks the trust boundary between tenants (S:C) and yields high confidentiality and integrity impact against OTHER deployments on the same host. The vuln.today decision label is 'this_week' rather than act_now/emergency, which is consistent with the moderate real-world urgency: no EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was provided - only the Elastic vendor advisory. The high-CVSS number is driven mainly by the scope change and dual H impact, not by ease of exploitation; the AV:L + AC:H + PR:H combination makes opportunistic mass exploitation unlikely and points to an insider or already-privileged tenant as the realistic threat actor. Missing/absent data to note: no EPSS probability and no KEV entry are available, so widespread active exploitation cannot be inferred; this appears vendor-reported and not yet observed in the wild.

A user who already controls one deployment (or a process) on a shared ECE host plants a malicious symlink so that ECE, when resolving a path, follows the link to a file belonging to another tenant. By winning the required conditions (AC:H), the attacker bypasses authentication and alters the configuration of co-located deployments they should not be able to touch. No public exploit code was identified at time of analysis; this reflects the vendor advisory only.