CVE-2026-110812: falha crítica em AWS Amazon Neptune Engine
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 0.4%
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.
To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
AWS · Amazon Neptune EngineReferências
https://aws.amazon.com/security/security-bulletins/2026-136-aws/https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.htmlhttps://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.htmlhttps://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html