WAF's HTTP/2 Blind Spot, and CitrixBleed Rides Again
AWS discloses an HTTP/2 body-inspection bypass in WAF rated CVSS 9.8, and a new CitrixBleed-class NetScaler flaw is exploited within 24 hours of its patch. On the launch side: ACM speaks ACME, GuardDuty watches sensitive file modifications, and WAF extends to AgentCore Gateway. Three more toolchain bulletins land on July 1.
In this issue2critical2high4medium1info
Highlights
4 items
$ tail -f /var/log/aws-security.log
critical/CVE/
CVE-2026-13762 / CVE-2026-13763: HTTP/2 Body Inspection Bypass in AWS WAF
AWS bulletin 2026-048-AWS discloses that crafted multi-frame HTTP/2 requests could cause AWS WAF to inspect only a partial request body, allowing managed-rule body inspection to be bypassed. The CloudFront variant (CVE-2026-13762) carries a CVSS 3.1 score of 9.8, critical, assigned by Amazon.
The CloudFront side was remediated server-side with no customer action required. For Application Load Balancer (CVE-2026-13763), AWS released a target-group configuration option on May 22, 2026: configure WAF HTTP/2 traffic inspection behavior in target group attributes so data frames accumulate before inspection.
If WAF fronts ALBs in your estate, make that target group change this week.
Affected
AWS WAF with CloudFront (remediated server-side)
AWS WAF with Application Load Balancer (customer action required)
Fixed In
CloudFront: no customer action
ALB: configure HTTP/2 inspection behavior in target group attributes
WAFCloudFrontELB
critical/Threat Intel/
CVE-2026-8451: New CitrixBleed-Class NetScaler Flaw Exploited Within 24 Hours
watchTowr Labs detailed CVE-2026-8451 (CVSS 8.8): an unauthenticated out-of-bounds memory read in the XML parser NetScaler ADC and Gateway use for SAML, reachable via the /saml/login endpoint on devices configured as SAML IdP. Leaked memory can include tokens and credentials, continuing the CitrixBleed lineage.
Citrix published its advisory and patches on June 30 (fixed in 14.1-72.61 and 13.1-63.18 per watchTowr); watchTowr, which reported the bug on March 28, released its analysis and proof of concept the same day. Follow-up reporting on July 3 cited Lupovis observations of broad, opportunistic in-the-wild exploitation within 24 hours of the advisory.
NetScaler VPX runs widely as an EC2 edge and VPN appliance. Patch, then rotate any sessions and credentials that transited affected boxes.
EC2VPC
medium/Feature Launch/
ACM Now Speaks ACME: Public Certificate Automation for Any Client
AWS Certificate Manager now exposes a managed ACME endpoint, announced June 30, compatible with Certbot, cert-manager, and acme.sh, issuing Amazon Trust Services public certificates.
The implementation includes External Account Binding credentials, domain-scope enforcement (exact, subdomain, or wildcard), Route 53 DNS validation, and CloudTrail and CloudWatch monitoring. Available in all commercial Regions, with GovCloud (US), China, and the European Sovereign Cloud planned; pricing is per-domain with volume discounts.
With certificate lifetimes shrinking, this pulls shadow ACME usage under centralized issuance governance.
GuardDuty Runtime Monitoring added three finding types on July 1: Persistence:Runtime/SensitiveFileModified, PrivilegeEscalation:Runtime/SensitiveFileModified, and DefenseEvasion:Runtime/SensitiveFileModified, covering EC2 instances and ECS and EKS container workloads.
The detections track five file operations (open-for-write, rename, symlink, link, unlink) against critical system files such as configuration files, authentication settings, and system logs. New Runtime Monitoring users get a 30-day free trial.
This targets post-compromise tampering with auth configs and logs, a gap between EDR-style detection and cloud-native telemetry.
GuardDutyEC2ECSEKS
CVEs & Vulnerabilities
3 items
$ cat /var/reports/CVE_REPORT.txt
medium/CVE/
CVE-2026-13769: AWS CLI Wrote Credential Files World-Readable
AWS bulletin 2026-049-AWS covers a file permissions flaw in the AWS CLI on Unix-like systems.
With an unrestrictive umask (the common default), the CLI wrote certain credential and configuration files world-readable, letting other local users on the same host read them. NVD scopes the issue to files written by aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register.
Update to CLI v1 1.44.78 or v2 2.34.29, and check permissions on files those commands created.
Affected
AWS CLI v1 <= 1.44.77
AWS CLI v2 <= 2.34.28
Fixed In
AWS CLI v1 1.44.78
AWS CLI v2 2.34.29
IAM
high/CVE/
CVE-2026-13760: Command Injection in CDK NodejsFunction Docker Bundling
AWS bulletin 2026-050-AWS covers the Docker-bundling companion to June's local-bundling flaw in aws-cdk-lib.
When nodeModules is specified, an attacker controlling dependency version strings in package.json can execute arbitrary commands on the host running the CDK toolchain via shell metacharacters.
Upgrade to aws-cdk-lib 2.260.0. Until then, use local bundling or only trusted dependencies.
Affected
aws-cdk-lib < 2.260.0 (NodejsFunction Docker bundling with nodeModules)
Fixed In
aws-cdk-lib 2.260.0
CloudFormationLambda
high/CVE/
CVE-2026-14265: Deserialization RCE Risk in the AWS Advanced JDBC Wrapper
AWS bulletin 2026-051-AWS covers the RemoteQueryCachePlugin in the AWS Advanced JDBC Wrapper, which deserialized cached query results from shared Redis or Valkey infrastructure without class filtering.
An actor with write access to the shared cache could insert a crafted serialized Java object that executes arbitrary code on application servers reading the cache. The plugin is disabled by default; NVD rates the issue up to CVSS 8.8.
Upgrade to 4.0.1 if you enable the plugin, and treat shared caches as trust boundaries.
AWS WAF protections can now be attached directly to Amazon Bedrock AgentCore Gateway, generally available since June 29: IP-based controls, rate-based rules, and AWS Managed Rule Groups including Bot Control.
A single protection pack at the Gateway applies consistently across all downstream tools and agents, in all Regions where both services are available. Agentic workloads get the same perimeter controls as web applications, without per-tool configuration.
WAFBedrock
info/Threat Intel/
AWS Threat Technique Catalog: Five New Entries, Heavy on EKS
The June 2026 update to the AWS Threat Technique Catalog, published June 29, adds five new entries and refreshes three.
New entries cover EKS workload modification, exploiting public-facing applications on EKS, assume-root into organization member accounts, compute hijacking on EKS, and invitations of accounts into unknown organizations. Refreshed entries include S3 Object Collection and role assumption variations. Watch sts:AssumeRoot calls and organizations:InviteAccountToOrganization / AcceptHandshake events in CloudTrail.
EKSS3CloudTrailOrganizations
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Two perimeter stories dominate: if AWS WAF fronts your ALBs, configure HTTP/2 inspection behavior in target group attributes now, and if you run NetScaler VPX on EC2 as a SAML IdP, patch and rotate immediately, exploitation started within a day. Then queue the July 1 toolchain patches: AWS CLI, aws-cdk-lib, and the Advanced JDBC Wrapper.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
