Dashboard / CVE-2026-119084

CVE-2026-119084

CRITICAL
INFO Priority: 0.04 BB Relevance: 78/100
Published: 2026-11-03 Modified: 2026-11-06 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: Present
VC: High
VI: High
VA: High

Description

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
AWS amazon-redshift-jdbc-driver 0 < 2.3.0
AWS amazon-redshift-jdbc-driver 0 < 2.3.0

References & Advisories (3)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.45%
Raw Score 0.004450
Percentile 39.2%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00445
2026-11-13
0.00445
2026-11-12
0.00445
2026-11-10
0.00445
2026-11-09
0.00445
2026-11-08
0.00445
2026-11-07
0.00445
2026-11-06
0.00445
2026-11-05
0.00445
2026-11-04
0.00445

Intelligence Sources

mitre ref →
nvd ref →

External Links