CVE-2026-110812

9.9Critical

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502, CWE-918

Impact

Authenticated attackers with basic database permissions can run arbitrary code and steal internal service credentials. They need valid access to the Neptune cluster to trigger the flaw.

Root cause

Insecure deserialization of untrusted user input within the Gremlin graph data import component.

Affected systems

Amazon Neptune engine versions prior to 1.4.7.1, 1.4.8.1, or 1.5.0.0.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade the Amazon Neptune engine to version 1.5.0.0, or apply backported versions 1.4.8.1 or 1.4.7.1 if on older branches.

shell

$ aws neptune modify-db-cluster --db-cluster-identifier <cluster-id> --engine-version 1.5.0.0 --apply-immediately

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110812