What’s Vulnerable › Vulnerabilities

CVE-2026-14265: RCE via Deserialization in AWS Advanced JDBC Wrapper

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-01 · updated 2026-10-25
• Weakness: CWE-502

Description

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

Affected products

• AWS Advanced JDBC Wrapper: from 3.3.0 before 4.0.1 — fixed in 4.0.1

How to fix

Upgrade to a fixed version: AWS Advanced JDBC Wrapper 4.0.1. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-051-aws/
• https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
• https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh

Get alerted when CVE-2026-14265 or the next vulnerability affects your stack