Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with…
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.x and 1.4.7.x)
Read at NIST National Vulnerability Database (CVE API 2.0)
- CVSS
- 9.9
- EPSS
- 0.004 (p30)
Why it ranks 24 (Routine)
- CVSS 9.9 critical
- Covered by 2 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-110812 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.