Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-216)
// AI summary
Elastic Cloud Enterprise (ECE) versions 3.8.6 and 4.2.1 received an update addressing Improper Link Resolution Before File Access (CWE-59) allowing unauthorized data disclosure and loss via Symlink Attack.
// from the source
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). Affected Versions: 2.x and 3.x: All versions from 2.6.0 up to and including 3.8.5 4.x: All versions from 4.0.0 up to