Elastic Cloud Enterprise EUVD-2026-112922

Exploitation requires a multi-tenant ECE host running multiple deployments, and the attacker must already hold high privileges (PR:H) within a co-located deployment on that same host to plant the symlink that ECE then follows across the deployment boundary. It is local only (AV:L) - there is no network-triggerable path in the supplied vector - and the impact is realized against OTHER deployments sharing the host (scope change). Limiting factors: single-tenant or isolated-host ECE deployments are not exposed to the cross-deployment disclosure/loss, and an attacker with no existing privileged deployment foothold cannot reach the condition. The exact filesystem operation and feature that resolves the link are not described in the available sources. The only confirmed remediation is upgrading to ECE 3.8.6 or 4.2.1 as stated in the vendor advisory.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) describes a locally-exploitable, high-privilege flaw whose severity is driven almost entirely by the scope change (S:C) and triple-high impact - the symlink attack lets one tenant reach data belonging to OTHER deployments on the same host, i.e. a cross-tenant boundary break. The attack vector is local (AV:L), not network, and requires high existing privileges (PR:H), so this is not a remotely-triggerable or unauthenticated issue despite the high base score. No EPSS score, no CISA KEV entry, and no proof-of-concept were supplied in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The vendor-assigned priority is 'this_week' rather than act_now/emergency, which is consistent with a high-impact but access-gated, non-wormable flaw. Net assessment: a genuine high-severity confidentiality/integrity risk specifically for multi-tenant ECE hosts, but the PR:H + AV:L gating means realistic risk is confined to environments where an attacker already controls a co-located deployment - treat as a real but scoped priority, not an internet-facing emergency. Note one inconsistency to verify with the vendor: the input Tags include 'Authentication Bypass', which does not match the CWE-59 link-following mechanism described.

An attacker who already controls one deployment (PR:H) on a shared ECE host plants a malicious symlink so that ECE file operations resolve across the deployment boundary. Because scope changes (S:C), the attacker reads or corrupts data belonging to co-located deployments they should not be able to touch. No public exploit code was identified, and exploitation requires local access to the shared host rather than a network request.