{"slug": "why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your", "title": "Why Nobody Has Exploited CVE-2026-110812 Yet, and Why That Should Not Set Your Timeline", "summary": "Amazon assigned CVE-2026-110812 on 15 October 2026, a deserialization flaw (CWE-502/CWE-918) in the Gremlin graph data import component of Amazon Neptune engine that lets an authenticated remote actor with standard database permissions execute arbitrary code and reach internal service credentials. Rated CVSS 3.1 9.9 and CVSS 4.0 9.4, it affects versions 1.2.0.0 up to below 1.5.0.0, with fixes in 1.4.7.1, 1.4.8.1 and 1.5.0.0; no public exploit or in-the-wild use has been confirmed, and EPSS stands at 0.4 percent over 30 days. The analysis argues the low exploitation estimate reflects the authentication requirement and private cluster topology rather than difficulty, and urges patching plus tightening neptune-db query permissions and credential lifetimes instead of deferring on the score alone.", "body_md": "A 9.9 with no public proof of concept and an EPSS of 0.4 percent is the kind of advisory that lands in a backlog. The reasoning is understandable and, for this specific flaw, partly correct. It is also fragile in a way worth spelling out.\n\nAmazon assigned CVE-2026-110812 on 15 October 2026 for deserialization of untrusted data in the Gremlin graph data import component of Amazon Neptune engine, with CWE-502 and CWE-918 as the listed weakness classes. An authenticated remote actor holding standard database permissions may execute arbitrary code and reach internal service credentials. CVSS 3.1 is 9.9; CVSS 4.0 is 9.4. Affected range is 1.2.0.0 up to below 1.5.0.0, with fixes in 1.4.7.1, 1.4.8.1 and 1.5.0.0.\n\nNo public exploit exists. No in-the-wild use has been confirmed.\n\nThe EPSS estimate of 0.4 percent over 30 days is not a placeholder. It reflects the authentication requirement and the fact that Neptune clusters are normally unreachable from the internet. An attacker needs a foothold that already grants query permission before the flaw matters, and that foothold is the harder part of the operation.\n\nFor organisations whose clusters are correctly private and whose query credentials are tightly held, the practical risk this month is small. Saying so honestly is better than inflating every critical score into a crisis.\n\nThree structural reasons argue against waiting.\n\nDeserialization flaws move from advisory to exploit once a researcher publishes a chain, and chains for Java-based graph engines are a well-developed research area. The absence of a public payload today is a statement about publication, not about difficulty.\n\nThe authentication barrier changes shape with cloud adoption. A query credential in a notebook, a shared test key, or an over-broad service role collapses PR:L to something closer to unauthenticated from the attacker's perspective inside an account. Credential hygiene at scale tends to degrade, not improve, across a quarter.\n\nThe flaw's stated payoff includes internal service credentials. That is a persistence multiplier. A flaw that only read graph data would rank differently in a queue than one whose success hands over credentials trusted elsewhere.\n\nZoomEye returned 547 assets for `http.body=\"gremlin\" && port=\"8182\"` on 27 October 2026. That figure describes Gremlin services reachable on the public internet. It is not a count of vulnerable Neptune clusters, and it does not change the exploitation assessment.\n\nIts one relevant contribution is scale context: Gremlin interfaces do appear on public addresses in the hundreds. Each of those is a query endpoint whose authentication model deserves a look, independent of this advisory.\n\nThe reasonable position sits between panic and postponement.\n\nPatch affected clusters to 1.5.0.0, or to 1.4.8.1 and 1.4.7.1 where the newest minor is blocked. Treat clusters with automatic minor version upgrade enabled as already scheduled and confirm the window; treat the rest as work with an owner and a date.\n\nUntil patched, restrict neptune-db query permissions to trusted principals, as AWS advises, and shorten credential lifetimes for whatever remains. Then use the interval to answer a question that outlives the CVE: which principals in this account can reach a graph import path, and does anyone review that list.\n\nIf the answer is that nobody reviews it, the flaw is not the finding. The finding is the access model, and it will still be there when the next advisory arrives.", "url": "https://wpnews.pro/news/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your", "canonical_source": "https://dev.to/facilishz/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your-timeline-2nhj", "published_at": "2026-10-27 16:41:03+00:00", "updated_at": "2026-10-27 16:41:59.374415+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Amazon", "Amazon Neptune", "Gremlin", "ZoomEye", "CVE-2026-110812"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your", "markdown": "https://wpnews.pro/news/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your.md", "text": "https://wpnews.pro/news/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your.txt", "jsonld": "https://wpnews.pro/news/why-nobody-has-exploited-cve-2026-110812-yet-and-why-that-should-not-set-your.jsonld"}}