CVE-2026-110812
CVSS: 9.9v3.1CriticalReceived
Published 2026-10-15Last modified 2026-10-15
Vulnerability summary
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 2026-10-15PublishedVulnerability first disclosed.
- 2026-10-15Last modifiedVulnerability information updated.
Description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVSS metrics
4 scores · 2 sources · 2 versionsCritical 9.4Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesAll 2 agree
- NVDNIST9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Aws1 product
- amazon neptune engine≥ 1.2.0.0, < 1.5.0.0
1 vendor · 1 product
References
4 links- aws.amazon.com/security/security-bulletins/2026-136-aws/Vendor Advisory