Vulnerability · Published Oct 15, 2026 · Assigned by AMZN
CVE-2026-110812Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Critical 9.9
In plain English
A critical-severity unsafe deserialization in Amazon Neptune Engine from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | Amazon Neptune Engine | 1.2.0.0 – before 1.5.0.0 |
Weakness: CWE-502, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html patch
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html patch
- https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html patch
- https://aws.amazon.com/security/security-bulletins/2026-136-aws/ vendor-advisory