CVE-2026-110812

critical · 9.4

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

9.4

CVSS

0.4%

EPSS (exploit prob.)

30th

EPSS percentile

2026-10-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-502CWE-918

References

https://aws.amazon.com/security/security-bulletins/2026-136-aws/
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-110812