Description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.



To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Published: 2026-10-15
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Deserialization of untrusted data in the Gremlin graph data import component represents a deserialization flaw (CWE-502) and allows an attacker with authenticated database permissions to exploit an arbitrary code execution weakness (CWE-918). The flaw enables execution of arbitrary code with Neptune service privileges, potentially exposing internal service credentials and compromising database integrity, confidentiality, and availability.

Affected Systems

Amazon Neptune Engine versions 1.4.7.1, 1.4.8.1, and 1.5.0.0 are affected. Users running earlier releases are not currently impacted by the vulnerability as identified by the CNA.

Risk and Exploitability

The CVSS score of 9.4 indicates a high severity with full confidentiality, integrity, and availability impact. The EPSS score of < 1% suggests a very low probability of exploitation at this time, and the issue is not currently in the CISA KEV catalogue. Exploitation requires only that the actor be authenticated with standard database permissions, which many internal users may possess, making the threat realistic. The attack likely proceeds via the graph-import API where malicious serialized objects are supplied, leading to arbitrary code execution on the Neptune host.

Generated by OpenCVE AI on October 16, 2026 at 21:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Amazon Neptune Engine to version 1.5.0.0, or backport the fix to 1.4.8.1 and 1.4.7.1 if auto‑update is not enabled.
  • If an immediate upgrade is not possible, restrict or disable the graph-import API for untrusted users by tightening IAM permissions or applying network firewall rules to limit access to trusted IP ranges.
  • Enable detailed monitoring of Neptune logs and create alerts for suspicious graph-import activity to detect potential exploitation attempts.

Generated by OpenCVE AI on October 16, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x) Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CPEs cpe:2.3:a:aws:amazon_neptune_engine:1.4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:aws:amazon_neptune_engine:1.4.8.1:*:*:*:*:*:*:*

Thu, 15 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)
Title Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
First Time appeared Aws
Aws amazon Neptune Engine
Weaknesses CWE-502
CWE-918
CPEs cpe:2.3:a:aws:amazon_neptune_engine:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws amazon Neptune Engine
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Aws Amazon Neptune Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-16T18:54:14.092Z

Reserved: 2026-10-14T19:48:17.745Z

Link: CVE-2026-110812

cve-icon Vulnrichment

Updated: 2026-10-16T18:54:09.400Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T17:17:16.110

Modified: 2026-10-16T19:17:03.750

Link: CVE-2026-110812

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T12:00:10Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

  • CWE-918

    Server-Side Request Forgery (SSRF)