CRITICAL 9.4 NVD
CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard da
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.
To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
References
- https://aws.amazon.com/security/security-bulletins/2026-136-aws/
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-10-15 via NVD.
Risk Timeline
CVE Disclosed2026-10-15 · -1 days ago
Remediation Resources
Official Advisory
aws.amazon.com/security/security-bulletins/2026-136-aws/
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.