CVE intelligence

CVE-2026-115710

Vulnerability intelligence

Published Nov 3, 2026Sources checked Nov 5, 2026

4.2MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-115710 and is rated Medium severity with a CVSS score of 4.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Nov 5, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-115710?

Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not.

A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results.

Disclosure is only possible when a user with full access ran the same query on the same shard recently.

Source: NVD