Deserialization Flaw in Amazon Neptune Engine by Amazon
CVE-2026-110812

9.4CRITICAL

Key Information:

Vendor

Aws

Status
Amazon Neptune Engine
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110812?

A vulnerability in the Gremlin graph data import component of the Amazon Neptune engine can allow an authenticated remote actor with standard database permissions to execute arbitrary code. This means that unauthorized actions can be performed, potentially leading to unauthorized access to internal service credentials. It is crucial for users to upgrade to the latest version of Amazon Neptune engine (1.5.0.0), with backports available for previous versions (1.4.8.x and 1.4.7.x) to mitigate this issue effectively.

Affected Version(s)

Amazon Neptune Engine 1.2.0.0 <= 1.5.0.0

References

https://docs.aws.amazon.com/neptune/latest/userguide/engi...
patch
https://docs.aws.amazon.com/neptune/latest/userguide/engi...
patch
https://docs.aws.amazon.com/neptune/latest/userguide/engi...
patch

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.