by Kastro
Paper/Archive/CVE-2026-110812

CVE-2026-110812

AWS Amazon Neptune Engine — Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
36
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 30.3.303 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

Affected

ProductAffectedFixed inSource
Amazon Neptune Engine1.2.0.0 – < 1.5.0.01.5.0.0CNA

Scores by source

AMZN (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AMZN (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchdocs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.htmlpatchdocs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.htmlpatchdocs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.htmladvisoryaws.amazon.com/security/security-bulletins/2026-136-aws