CVE-2026-110812— Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Quick assessment
Affected
AWS Amazon Neptune Engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Amazon Neptune 引擎中 Gremlin 图数据导入组件的不可信数据反序列化漏洞，可能导致拥有标准数据库权限的已认证远程攻击者执行任意代码并访问内部服务凭证。 为解决此问题，未启用自动更新的用户应将 Amazon Neptune 引擎升级至版本 1.5.0.0（已向后移植至 1.4.8.x 和 1.4.7.x 版本）。
Possible ATT&CK Techniques 3 AI
T1003 · OS Credential Dumping T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AWS | Amazon Neptune Engine | 1.2.0.0< 1.5.0.0 |
affected |
1.4.7.1 |
unaffected | ||
1.4.8.1 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110812
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.
To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | Amazon Neptune Engine | 1.2.0.0 ~ 1.5.0.0 | - |
|
II. Public POCs for CVE-2026-110812
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110812
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-110812 (1)
Vendor Pages for CVE-2026-110812 (2)
Other References for CVE-2026-110812 (1)
IV. Related Vulnerabilities
Same vendor: AWS
-
CVE-2026-110248
Insertion of sensitive information into log files in Amazon -
CVE-2026-108096
Improper authorization in query resolvers for SQL-backed mod -
CVE-2026-107783
Insertion of sensitive information into log file in AWS Tool -
CVE-2026-107608
Improper link resolution in asset bundling output handling i -
CVE-2026-107322
OS command injection in Amazon Agent Plugins for AWS databas
Same weakness: CWE-502
-
CVE-2026-97296
WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injectio -
CVE-2026-104730
Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object In -
CVE-2026-104932
Search Regex 3.5 - Authenticated (Subscriber+) Remote Code E -
CVE-2026-75941
联想Legion Zone应用远程代码执行漏洞 -
CVE-2026-111160
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_p
V. Comments for CVE-2026-110812
No comments yet