CVE-2026-85656: OS command injection in Amazon log4j-cve-2021-44228-hotpatch

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-08
Weakness: CWE-78

Description

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Affected products

Amazon Web Services log4j-cve-2021-44228-hotpatch: before 1.3-9.amzn2 — fixed in 1.3-9.amzn2

How to fix

Upgrade to a fixed version: Amazon Web Services log4j-cve-2021-44228-hotpatch 1.3-9.amzn2. Check the vendor advisory for mitigations.

References

https://alas.aws.amazon.com/AL2/ALAS2-2026-3784.html
https://aws.amazon.com/security/security-bulletins/2026-098-aws/

Get alerted when CVE-2026-85656 or the next vulnerability affects your stack