CVE-2026-14265— RCE via Deserialization in AWS Advanced JDBC Wrapper
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1210 · Exploitation of Remote ServicesGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RCE via Deserialization in AWS Advanced JDBC Wrapper
Source: NVD (National Vulnerability Database)
Vulnerability Description
Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | AWS Advanced JDBC Wrapper | 3.3.0 ~ 4.0.0 | - |
II. Public POCs for CVE-2026-14265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14265
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14265 (2)
Vendor Pages for CVE-2026-14265 (1)
Same Patch Batch · AWS · 2026-07-01 · 3 CVEs total
| CVE-2026-13760 | 7.3 HIGH | OS Command Injection in aws-cdk-lib Docker Bundling |
| CVE-2026-13769 | 5.5 MEDIUM | Overly permissive File Permissions in AWS CLI |
IV. Related Vulnerabilities
Same vendor: AWS
- CVE-2026-13760
OS Command Injection in aws-cdk-lib Docker Bundling - CVE-2026-13769
Overly permissive File Permissions in AWS CLI - CVE-2026-13763
HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS - CVE-2026-13762
HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Ama - CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedroc
Same weakness: CWE-502
- CVE-2026-56037
WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injecti - CVE-2026-57677
WordPress Novalnet Payment Gateway for WooCommerce plugin <= - CVE-2026-57621
WordPress Booktics plugin <= 1.0.21 - PHP Object Injection v - CVE-2026-27414
WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vu - CVE-2026-27060
WordPress ARMember Premium plugin <= 7.0 - PHP Object Inject
V. Comments for CVE-2026-14265
No comments yet