# CVE-2026-110812: Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

> CVE-2026-110812: Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune. CVSS 9.9 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-110812
Last updated: 2026-10-16T19:17:03Z

- Published: 2026-10-15 16:34 UTC · Updated: 2026-10-16 19:17 UTC · Assigner: AMZN
- CVSS: 9.9 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS: 0.37%, 30th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-502, CWE-918

## Description

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

## Affected vendors and products

- AWS: Amazon Neptune Engine

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-110812)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-110812)
- [https://aws.amazon.com/security/security-bulletins/2026-136-aws/](https://aws.amazon.com/security/security-bulletins/2026-136-aws/)
- [https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html](https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html)
- [https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html](https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html)
- [https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html](https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-110812 · Markdown: https://rewindex.com/cve/CVE-2026-110812.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-110812 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:45.077Z