Dashboard / CVE-2026-14265

CVE-2026-14265

HIGH
MEDIUM Priority: 0.06 BB Relevance: 66/100
Published: 2026-07-01 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: High
VI: High
VA: High

Description

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
amazon advanced_jdbc_wrapper 3.3.0 – 4.0.1

References & Advisories (3)

https://aws.amazon.com/security/security-bulletins/2026-051-aws/
Release Notes Vendor Advisory Mitigation

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.73%
Raw Score 0.007270
Percentile 54.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00727
2026-10-28
0.00727

Intelligence Sources

nvd ref →

External Links