Elastic Cloud Enterprise (ECE) 4.2.1 Security Update (ESA-2026-222)
// AI summary
Elastic Cloud Enterprise (ECE) 4.2.1 has a Link Following flaw (CWE-59) allowing unauthorized read and write access to other deployments on the same host via Symlink Attack.
// from the source
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). Affected Versions: 4.x: All versions from 4.1.0 up to and including 4.2.0 Users on the 3.x release line, including 3