Elastic Cloud Enterprise EUVD-2026-112925

Requires a multi-tenant deployment: two or more Elastic Cloud Enterprise deployments co-located on the same host, since the impact is unauthorized access to OTHER deployments' data on that host. The attacker must already have local, high-privilege access within a deployment (PR:H, AV:L) sufficient to create or influence a symlink that an ECE file operation subsequently resolves. Limiting factors: no remote or network-facing vector (AV:L), high attack complexity (AC:H) implying conditions the attacker does not fully control, and the need for pre-existing privileged local access - so single-tenant hosts and non-privileged remote attackers are not exposed. The only confirmed remediation in the source is updating to ECE 4.2.1.

This is a moderate-priority, high-prerequisite vulnerability rather than a widespread emergency, and the signals are consistent rather than conflicting. The vendor-supplied CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 7.5) describes an attack that requires local access and high privileges, succeeds only under high attack complexity, but crosses a scope boundary to fully compromise the confidentiality, integrity, and availability of OTHER deployments co-located on the same host - a multi-tenant isolation breach. No EPSS score, no CISA KEV listing, and no proof-of-concept reference are present in the supplied data, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' which aligns with a real but not drop-everything priority: the high PR:H/AC:L[sic AC:H] barrier limits mass exploitation, but the cross-deployment data read/write impact makes it serious for operators running multiple tenants on shared ECE hosts. The 'Authentication Bypass' tag overstates the mechanism - CWE-59 (Link Following) is a file-access/isolation flaw, not an authentication bypass; treat that label with caution. Automatable exploitation is unlikely given AC:H and PR:H.

An attacker (or a compromised tenant) who already holds privileged local access within one deployment on a shared ECE host plants a crafted symlink so that an ECE file operation resolves it to files belonging to a different deployment on the same host. When the privileged ECE process follows the link, the attacker gains unauthorized read and write access to another deployment's data. No public exploit code is identified in the supplied data, and the high attack complexity means success is not guaranteed on every attempt.