All vulnerabilities
CVE-2026-110812

Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

AWS Amazon Neptune EngineContainers & cloud
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.5.0.0Fixed versionCVE List
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.

To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

Text from CVE List

Affected versions 3

  • Amazon Neptune Engineaffected: 1.2.0.0 before 1.5.0.0CVE List
  • Amazon Neptune Engineunaffected: 1.4.7.1CVE List
  • Amazon Neptune Engineunaffected: 1.4.8.1CVE List

References 4