What’s Vulnerable › Vulnerabilities

CVE-2026-94384: Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-22 · updated 2026-09-22
• Weakness: CWE-862

Description

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.

Affected products

• amazon-connect-salesforce-lambda: from 5.15 through 5.24.16

References

• https://aws.amazon.com/security/security-bulletins/2026-115-aws/
• https://github.com/amazon-connect/amazon-connect-salesforce-cti/security/advisories/GHSA-c9j2-qjfv-mm4p
• https://github.com/amazon-connect/amazon-connect-salesforce-lambda/releases/tag/v5.26

Get alerted when CVE-2026-94384 or the next vulnerability affects your stack