CVE-2026-110812CWE-502CWE-918insecure-deserializationssrf

CVE-2026-110812

Critical · published October 15, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.

To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00365 · 29.2th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-15T21:17Z
References (4)
https://aws.amazon.com/security/security-bulletins/2026-136-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html · ff89ba41-3aa1-4d27-914a-91399e9639e5https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html · ff89ba41-3aa1-4d27-914a-91399e9639e5https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 16:34Z
    Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
    cvelistv5
  • 15 OCT 16:34Z
    Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
    cvelistv5