Answer in brief
CVE-2026-110812 records a Critical severity (CVSS 9.4) vulnerability in Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune. The current sources do not mark it as known exploited. The current feed maps AWS/Amazon Neptune Engine (generic), AWS/Amazon Neptune Engine (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AWS/Amazon Neptune Engine (generic), AWS/Amazon Neptune Engine (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AWS/Amazon Neptune Enginegeneric | >=1.2.0.0 <=1.5.0.0 | Not reported |
| AWS/Amazon Neptune Enginegeneric | >=1.2.0.0 <1.5.0.0 | 1.5.0.0 |
Published upstream
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Quoted source text, attributed separately from HOL analysis.