CVE-2026-110812criticalCWE-502 CWE-918

CVE-2026-110812: fallo crítico en AWS Amazon Neptune Engine

Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Publicada el 15 oct 2026 · Actualizada el 16 oct 2026

Seguir esta CVE + Monitorear Amazon Neptune Engine

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 0.4%

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Productos afectados

AWS · Amazon Neptune Engine

Referencias

https://aws.amazon.com/security/security-bulletins/2026-136-aws/https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html