AWS Security Digest·Week 42 of 2026·Oct 12-18, 2026·13 items
Six AWS Bulletins: A Neptune Flaw Rated 9.9 and a KVM Host-Memory Issue
Six new AWS security bulletins this week, led by an Amazon Neptune query-engine issue that its CVE record scores 9.9 (CRITICAL) and a Linux kernel virtio-net/TAP flaw that affects self-managed KVM hosts but not EC2, Lambda or Fargate. On the defensive side, OpenSearch Service gets per-index KMS keys, Security Hub adds resource criticality and the Cyber Risk Institute profile, Secrets Manager rotates Databricks and Twilio credentials, and Transfer Family host keys can live in Secrets Manager.
In this issue1critical3high2medium7info
Highlights
2 items
$ tail -f /var/log/aws-security.log
critical/CVE/
CVE-2026-110812: Deserialization of Untrusted Data in the Gremlin Graph-Import Path of Amazon Neptune
AWS disclosed an issue in Apache TinkerPop's Gremlin functionality as used by Amazon Neptune. Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that makes the query engine process untrusted input unsafely, which could lead to unintended activity within the query engine environment (CVE-2026-110812).
The AWS bulletin itself is restrained, but the CVE record's CNA scores it CVSS 3.1 9.9 (CRITICAL) with changed scope (NVD lists that score as secondary and had not analyzed the CVE on October 20), and the CVE record's description says the flaw might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. AWS states that customers with auto minor version upgrade enabled receive the update during their next maintenance window, and customers who manage engine versions manually should upgrade.
Until you can upgrade, AWS advises least-privilege practices: grant Neptune neptune-db (query) permissions only to trusted principals.
Affected
Amazon Neptune engine versions >= 1.2.0.0 (as printed in the bulletin)
Fixed In
Neptune engine 1.4.7.1, 1.4.8.1 or 1.5.0.0
Neptune
high/CVE/
Linux Kernel virtio-net/TAP Issue Affects Self-Managed KVM Hosts, Not EC2, Lambda or Fargate
AWS is aware of an issue in the Linux kernel's virtio-net/TAP networking path (CVE-2026-99999, as printed in the bulletin) that affects KVM-based hypervisors running unpatched kernel versions 4.4 through 6.18. An actor with privileged access inside a guest virtual machine could send specially crafted network packets that corrupt host kernel memory, which could result in disclosure of host memory or a denial of service.
AWS states that AWS-managed compute and container services, including Amazon EC2 instances, AWS Lambda and AWS Fargate, are not affected and need no customer action. The affected population is customers who self-manage virtual machines with virtio-net and KVM, including those using virtual machine monitors such as Firecracker.
There are no workarounds. On Amazon Linux, AWS recommends applying the updated kernel packages to the host and rebooting; users of other distributions should apply their vendor's kernel updates. The bulletin credits Paulos Yibelo of pwn.ai and does not state a CVSS score. Note that the NVD description of CVE-2026-99999 on October 20 reads as a different bug (an IPv4 checksum_start fix), so the ID as printed in the bulletin may not match what you find on NVD.
Affected
Self-managed KVM hosts using virtio-net on unpatched Linux kernels 4.4 through 6.18
Fixed In
Amazon Linux 2 (these kernel versions or later): 4.14.355-287.750, 5.4.302-229.494, 5.10.269-270.1108, 5.15.220-156.256
Amazon Linux 2023 (these versions or later): kernel 6.1.188-233.385, kernel6.12 6.12.110-135.201, kernel6.18 6.18.51-120.162
EC2LambdaFargate
CVEs & Vulnerabilities
4 items
$ cat /var/reports/CVE_REPORT.txt
medium/CVE/
CVE-2026-110248: SageMaker Python SDK Writes Git Credentials to CloudWatch Logs After a Failed Clone
When a Git clone operation fails in the Amazon SageMaker Python SDK, repository credentials in the subprocess error output are written to CloudWatch Logs without redaction, so an authenticated remote user with access to those logs can obtain the plaintext credentials.
Upgrade to V2 2.257.3 or V3 3.10.0 and make sure forked or derivative code includes the fix. If you cannot upgrade immediately, AWS advises keeping credentials out of Git repository URLs and restricting access to the CloudWatch Logs that hold SDK output; it also advises reviewing the logs of failed clone operations and rotating any credentials that appeared in them. The bulletin credits Gouri Sankar A.
Affected
Amazon SageMaker Python SDK V2 before 2.257.3
Amazon SageMaker Python SDK V3 before 3.10.0
Fixed In
SageMaker Python SDK V2 2.257.3
SageMaker Python SDK V3 3.10.0
SageMakerCloudWatch
medium/CVE/
CVE-2026-110310: Padding Oracle via Legacy Key Format Downgrade in the Amazon S3 Encryption Client for .NET
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to the legacy PKCS#1 v1.5. Because that scheme is susceptible to the Bleichenbacher attack, the user can use a padding oracle to recover the RSA-wrapped envelope key and decrypt the object.
AWS lists the fixed versions as 3.2.2 (3.x line) and 4.0.3 (4.x line), says there is no workaround, and states that the 1.x and 2.x lines will not receive patches, so users of those versions must migrate to 3.2.2 or 4.0.3. The affected-versions line in the bulletin reads ">= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2" and is reproduced here as printed.
Affected
Amazon S3 Encryption Client for .NET: >= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2 (as printed)
Fixed In
S3 Encryption Client for .NET 3.2.2 or 4.0.3
S3KMS
high/CVE/
CVE-2026-109587 and CVE-2026-109588: FreeRTOS-Kernel Cortex-R82 MPU Port Might Let Unprivileged Tasks Reach Kernel Memory
Two issues in the Arm Cortex-R82 (Armv8-R AArch64) MPU port of FreeRTOS-Kernel V11.3.0 and V11.3.1. CVE-2026-109587 is an incorrect authorization: the port does not enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer to an MPU system call, so the task might read and write privileged kernel memory outside its regions. CVE-2026-109588 is a numeric truncation in the buffer authorization check for stream buffer system calls, which might allow reads or writes of privileged kernel memory beyond the validated buffer window.
Both affect only Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected. The fix is FreeRTOS-Kernel V11.3.2. The bulletin credits Ada Logics Ltd and Anthropic.
Affected
FreeRTOS-Kernel V11.3.0 and V11.3.1 (Arm Cortex-R82 port with configENABLE_MPU=1)
Fixed In
FreeRTOS-Kernel V11.3.2
FreeRTOS
high/CVE/
CVE-2026-102551 and CVE-2026-102552: FreeRTOS-Plus-TCP IPv6 Router Advertisement and DNS Source Verification
CVE-2026-102551 is an improper verification of the source of a communication channel in the IPv6 Router Advertisement handler: a remote third party might influence a device's IPv6 gateway, prefix and address configuration, potentially intercepting its IPv6 traffic. AWS says it is reachable in the default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled. CVE-2026-102552 is the same class of flaw in the DNS resolver: a remote third party might insert a chosen address into the device's DNS cache.
Both affect versions up to and including V4.4.1 and are fixed in V4.4.2, but upgrading alone does not fix the DNS issue: responder source-IP validation is an opt-in option that is disabled by default, so you must also enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h. If upgrading is not immediately possible, AWS suggests disabling ipconfigUSE_RA for the Router Advertisement issue where autoconfiguration is not required, and states there is no configuration-only workaround for the DNS issue. The bulletin credits "Cipher / Causal Security" (as printed).
Affected
FreeRTOS-Plus-TCP V4.4.1 and earlier
Fixed In
FreeRTOS-Plus-TCP V4.4.2, plus ipconfigDNS_CHECK_REPLY_SOURCE_IP enabled for the DNS issue
Security Hub Adds Resource Criticality to Exposure Prioritization
AWS Security Hub now factors resource criticality into exposure prioritization, so central security teams can focus on exposures that threaten their most business-critical resources. You can set criticality with an automation rule, for example marking every compute resource in a specific account as Very High, and Security Hub also infers criticality from resource tags and names with no configuration, recording which source determined the value.
Criticality appears as a column on the Resources page and on the Impact assessment tab of an exposure finding. AWS states it is included with Security Hub Essentials at no additional cost and is always on.
Security Hub
info/Compliance/
Security Hub CSPM Adds the Cyber Risk Institute Profile v2.2
AWS Security Hub CSPM now offers automated checks aligned with the Cyber Risk Institute (CRI) Profile, a cybersecurity framework from a non-profit coalition of financial institutions and trade associations that harmonizes sector regulatory expectations. AWS provides 404 controls that support a subset of CRI Profile v2.2 requirements; the controls do not cover requirements that need manual checks.
The standard is available in all Regions where Security Hub CSPM is available, including GovCloud (US) and the China Regions, and AWS recommends enabling it through Security Hub central configuration.
Security Hub CSPM
info/Feature Launch/
OpenSearch Service Adds Index-Level Encryption With Per-Index KMS Keys
Amazon OpenSearch Service can now encrypt each index at rest with its own AWS KMS customer managed key, which lets you keep data with different ownership or sensitivity under separate keys on the same domain, for example one key per tenant in a multi-tenant application.
It is available for domains running OpenSearch 3.3 or later in 14 Regions. To enable it, set the encryption mode to Native and specify a customer managed key when you create a new domain, then register additional keys and use them for individual indexes. AWS states there is no additional charge for the feature; standard KMS and OpenSearch Service charges apply.
OpenSearch ServiceKMS
info/Feature Launch/
Secrets Manager Managed External Secrets Now Rotate Databricks and Twilio Credentials
AWS Secrets Manager extends managed external secrets to Databricks and Twilio, so you can rotate those credentials from the console or API without writing a custom rotation Lambda function. For Databricks it covers the personal access tokens used by jobs and CI/CD pipelines and the service principal OAuth client secrets; AWS states each replacement token keeps the scopes of the token it replaces. For Twilio it covers API keys and Auth Tokens.
You store the credential as a managed external secret and set a rotation schedule; Secrets Manager always returns the current value, so applications pick up rotated credentials without code changes. Availability is all Regions where managed external secrets is supported.
Secrets Manager
info/Feature Launch/
Transfer Family Can Store SFTP Server Host Keys in Secrets Manager
AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own account. Previously the service stored host keys internally, so you could not retrieve the private key material. You can now choose Secrets Manager as the storage type when creating a server or importing a host key, retrieve the key, and reuse the same host key across servers and Regions, for example on a standby server for failover, without clients having to trust a new key.
IAM policies control who can retrieve the stored keys. Migrating existing host keys to Secrets Manager may require additional steps, which AWS documents in the Transfer Family User Guide. Available in all Regions where Transfer Family is available.
Transfer FamilySecrets Manager
info/Compliance/
Amazon Braket Is Now in Scope for FedRAMP Class C
Amazon Braket is now in scope for FedRAMP Class C in the AWS US Regions where it is available (US East N. Virginia, US West N. California, US West Oregon). The AWS-operated components, including the API and SDK, job orchestration and management, compilation and result storage in Amazon S3, are within the FedRAMP-certified boundary.
Quantum workloads themselves run on third-party Quantum Hardware Providers outside that boundary. AWS states that data sent to those providers meets AWS privacy and security requirements, including removal of all personally identifiable information and encryption in transit and at rest.
Braket
info/Service Update/
AWS Reports Its Security Agent Exploited 33 of 37 New Real-World CVEs in an Internal Benchmark
AWS published results for AWS Security Agent, now part of AWS Continuum (the penetration testing product is now called AWS Continuum for penetration testing), on an internally developed benchmark of 37 real CVEs from 2025 and 2026. Each CVE was a containerized target with a hidden flag, and the agent started from an endpoint URL and a one-line hint, with no exploit or proof of concept. The run used Claude Opus 5 with a 10-hour limit per sample.
AWS reports 35 of 37 flags captured and 33 of 37 (89.2 percent) captured through the intended vulnerability, confirmed by an audit against each challenge's canonical proof of concept. Two captures were reclassified as off the intended path, and in two misses the agent took the target down before reading the flag. AWS says the benchmark covers known-CVE reproduction rather than novel discovery and calls the result contamination-reduced, not contamination-free.
These are AWS's own figures and have not been independently verified. This is a different benchmark from the CyberGym-E2E result AWS reported for AWS Continuum in the previous week; the two should not be compared as one number.
AWS ContinuumAWS Security Agent
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Check two things first. If you run Neptune with manually managed engine versions, upgrade to 1.4.7.1, 1.4.8.1 or 1.5.0.0 and limit neptune-db permissions to trusted principals. If you operate your own KVM hosts, patch the kernel and reboot, because AWS lists no workaround. Then look at the long tail: the S3 Encryption Client for .NET 1.x and 2.x lines will not be patched, and the FreeRTOS-Plus-TCP DNS issue needs a configuration option enabled on top of the upgrade.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
