Elastic Cloud Enterprise
Approved changes feed: RSS · Atom
cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Elastic (1d0b8d2a-fd47-5b20-b005-34326f9bd037) |
|---|---|
| Product | Elastic Cloud Enterprise (080f5f74-24ad-5d59-a3d7-8ab5a90806ac) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115707 |
vulnerable | 2026-11-03 10:15:37.783761 |
Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
MEDIUM (6.4)
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.
Published: 2026-10-29T14:09:59.890Z
Updated: 2026-10-30T17:18:28.898Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115713 |
vulnerable | 2026-11-03 10:15:37.682698 |
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
HIGH (7.5)
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
Published: 2026-10-29T14:10:08.088Z
Updated: 2026-10-30T03:56:09.946Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115712 |
vulnerable | 2026-11-03 10:15:37.595637 |
Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
MEDIUM (4.3)
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
Published: 2026-10-29T14:10:06.580Z
Updated: 2026-10-29T16:49:21.112Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115706 |
vulnerable | 2026-11-03 10:15:37.574239 |
Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
MEDIUM (6.8)
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Published: 2026-10-29T14:09:58.330Z
Updated: 2026-10-30T17:18:29.029Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115708 |
vulnerable | 2026-11-03 10:15:37.430817 |
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass
HIGH (7.2)
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
Published: 2026-10-29T14:10:01.656Z
Updated: 2026-10-30T17:18:28.766Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115711 |
vulnerable | 2026-11-03 10:15:37.228726 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115709 |
vulnerable | 2026-11-03 10:15:37.204495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-37736 |
vulnerable | 2026-06-08 07:21:02.346214 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-37729 |
vulnerable | 2026-06-08 07:21:02.341013 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37282 |
vulnerable | 2026-06-08 06:39:47.049854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31418 |
vulnerable | 2026-06-08 06:04:43.097353 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23716 |
vulnerable | 2026-06-08 05:40:58.285058 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23715 |
vulnerable | 2026-06-08 05:40:58.284588 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3829 |
vulnerable | 2026-06-08 05:11:41.319311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3828 |
vulnerable | 2026-06-08 05:11:41.318996 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3825 |
vulnerable | 2026-06-08 05:11:41.313953 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-8444 |
vulnerable | 2026-06-08 05:10:08.229408 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.