High severity · published Jul 1, 2026
CVE-2026-14265
RCE via Deserialization in AWS Advanced JDBC Wrapper
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned.
We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AWS Advanced JDBC Wrapper · AWS
3.3.0 through 4.0.0 · source: vendor
AJ
Advanced Jdbc Wrapper · Amazon
3.3.0 before 4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14265
Release Notes
https://aws.amazon.com/security/security-bulletins/2026-051-aws/
Release Notes
https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
Vendor Advisory
https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh
More from AWS Advanced JDBC Wrapper
8.0
CVE-2026-11400
Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
5.9
CVE-2026-18061
Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin