CVE-2026-110812: critical vulnerability in AWS Amazon Neptune Engine
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.4%
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.
To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
AWS · Amazon Neptune EngineReferences
https://aws.amazon.com/security/security-bulletins/2026-136-aws/https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.htmlhttps://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.htmlhttps://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html