Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)
// AI summary
Elastic Cloud Enterprise (ECE) versions 3.8.6 and 4.2.1 received a security update addressing CWE-538, which allows privilege escalation via retrieving embedded sensitive data.
// from the source
Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lo