Critical severity · published Oct 15, 2026
CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
9.9
CVSS
0.4%
EPSS
No
On KEV
Description
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials.
To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Amazon Neptune Engine · AWS
1.2.0.0 before 1.5.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110812
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-136-aws/
docs.aws.amazon.com
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html
docs.aws.amazon.com
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html
docs.aws.amazon.com
https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html