# Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-221)

**URL:** <https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265>\
**Category:** Security Announcements\
**Created:** [October 29, 2026, 10:47am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265 "2026-10-29T10:47:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Post date:** [October 29, 2026, 10:47am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265/1 "2026-10-29T10:47:21Z")

</div>

**Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings**

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.

**Affected Versions:**

> - 3.x: All versions from 3.8.0 up to and including 3.8.5
> - 4.x: All versions from 4.0.0 up to and including 4.2.0

**Affected Configurations:**

> - All configurations are affected.

**Solutions and Mitigations:**

The issue is resolved in version 3.8.6 and 4.2.1.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes/cloud-enterprise) for your target version before upgrading.

**For Users that Cannot Upgrade:**

> - There are no workarounds for this vulnerability.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Severity:** CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N  
**CVE ID:** CVE-2026-115712  
**Problem Type:** CWE-863 - Incorrect Authorization  
**Impact:** CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs