Elastic Cloud Enterprise 3.8.6 and 4.2.1 fix seven security flaws

Elastic Cloud Enterprise 3.8.6 and 4.2.1 fix seven security flaws

29 October 2026: Elastic has published seven security advisories for Elastic Cloud Enterprise (ECE), the software companies use to run their own fleet of Elasticsearch deployments on shared hosts. The fixes are in ECE 3.8.6 and 4.2.1; one, ESA-2026-222, is fixed only in 4.2.1. Scores run from 4.3 to 8.2, and Elastic does not report exploitation. Elastic lists interim workarounds for only two of the seven, so most installations need the upgrade.

Not yet independently verified. Not yet independently verified. This rests on Elastic's own advisories; we read one in full and the others' scores and workarounds from their summaries. We will update this when it can be confirmed, and remove this note.

Data belonging to other deployments

The highest-rated, ESA-2026-216 (CVE-2026-115709, CVSS 8.2), is a symlink flaw: ECE did not resolve links safely before accessing files, which can lead to disclosure and loss of data belonging to other deployments on the same host. In an ECE installation, many deployments, often for different teams or customers, share physical hosts, so the separation between them is the product's core promise. A flaw that crosses it matters most to service providers and internal platform teams that run deployments for several groups on the same machines. Affected versions run from 2.6.0 to 3.8.5 and from 4.0.0 to 4.2.0.

The full list

Advisory	CVE	CVSS	Fixed in
ESA-2026-211	CVE-2026-115706	6.8	3.8.6, 4.2.1
ESA-2026-212	CVE-2026-115707	6.4	3.8.6, 4.2.1
ESA-2026-215	CVE-2026-115708	7.2	3.8.6, 4.2.1
ESA-2026-216	CVE-2026-115709	8.2	3.8.6, 4.2.1
ESA-2026-218	CVE-2026-115711	6.4	3.8.6, 4.2.1
ESA-2026-221	CVE-2026-115712	4.3	3.8.6, 4.2.1
ESA-2026-222	CVE-2026-115713	7.5	4.2.1 only

Planning the upgrade

ECE upgrades are staged across the hosts of an installation, so they take planning. Installations still on the 3.x line can stay there with 3.8.6, except for the flaw fixed only in 4.2.1, which leaves 3.x users exposed to ESA-2026-222 until they move to 4.x. Elastic gives interim workarounds for two of the advisories, ESA-2026-212 and ESA-2026-218; each advisory's own page is the reference for those steps.

Elastic Cloud, Elastic's own hosted service, is run by Elastic and is not part of these advisories. We list Elastic as a company; our enterprise search software category lists 19 products.

Related on TrustList:

• Elastic patches 14 flaws across Elasticsearch, Kibana and Endpoint

Sources

• Elastic security announcements: ECE 3.8.6 and 4.2.1 (ESA-2026-211, 212, 215, 216, 218, 221, 222), 29 October 2026