# Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-212)

**URL:** <https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261>\
**Category:** Security Announcements\
**Created:** [October 29, 2026, 10:45am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261 "2026-10-29T10:45:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Post date:** [October 29, 2026, 10:45am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261/1 "2026-10-29T10:45:48Z")

</div>

**Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation**

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.

**Affected Versions:**

> - 2.x and 3.x: All versions from 2.6.0 up to and including 3.8.5
> - 4.x: All versions from 4.0.0 up to and including 4.2.0

**Affected Configurations:**

> - Only ECE installations on which the certificate rotation procedure was run are affected. Exploitation requires administrative access to at least one host in the ECE installation, or access to the internal ECE platform services from the network. ECE hosts and the internal ECE network are intended to be accessible only to trusted administrators. This deployment model limits exposure to this vulnerability.

**Solutions and Mitigations:**

The issue is resolved in version 3.8.6 and 4.2.1.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes/cloud-enterprise) for your target version before upgrading.

If the certificate rotation procedure was run on your installation, run the cleanup command of the certificate rotation procedure from a host that has the director role after you upgrade. This removes the retained rotation data from the installation. ECE does not currently provide a procedure to rotate the ZooKeeper root password or the certificate authority keys.

**For Users that Cannot Upgrade:**

> - If the certificate rotation procedure was run on your installation, run its cleanup command from a host that has the director role. Do not run the certificate rotation procedure again until you upgrade to a fixed version.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Severity:** CVSSv3.1: Medium ( 6.4 ) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H  
**CVE ID:** CVE-2026-115707  
**Problem Type:** CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory  
**Impact:** CAPEC-37 - Retrieve Embedded Sensitive Data