Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the ins…

Read on Elastic Security Announcements

On 10/29/2026, 07:45 PM, Elastic Security Announcements published "Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)" (type: Advisory). Related technologies: Elasticsearch / OpenSearch.