Critical severity9.9NVD Advisory· Published Oct 15, 2026

CVE-2026-110812

Description

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.

To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)

Affected products

Amazon/Neptunellm-create
Range: up to 1.5.0.0 (backported to 1.4.8.x and 1.4.7.x)

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-136-aws/nvd
docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.htmlnvd
docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.htmlnvd
docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000