What’s Vulnerable › Vulnerabilities

CVE-2026-110812: Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-502

Description

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

Affected products

• AWS Amazon Neptune Engine: from 1.2.0.0 before 1.5.0.0 — fixed in 1.5.0.0

How to fix

Upgrade to a fixed version: AWS Amazon Neptune Engine 1.5.0.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-136-aws/
• https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html
• https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html
• https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html

Get alerted when CVE-2026-110812 or the next vulnerability affects your stack