Threat level Severe
Contact
Critical 9.9
CVE-2026-110812

AWS Amazon Neptune Engine — remote code execution.

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access…

WeaknessCWE-502: Unsafe deserializationCWE-918: Server-side request forgery
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.4%
Higher than 30% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.

To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

What to do

  1. 01Check whether you run AWS Amazon Neptune Engine, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
AWS3 CVEs in 30 days
All AWS CVEs

Other CVEs from AWS

4 more CVEs

All AWS CVEs
9.8AWS multi-model-server — remote code execution.EPSS 0.5%9.0AWS bedrock-agentcore-starter-toolkit — remote code execution.EPSS 0.3%9.0AWS sagemaker-distribution — remote code execution.EPSS 1.4%10.0AWS loom — missing authentication.EPSS 2.5%