AWS Advanced JDBC Wrapper Java Deserialization RCE Vulnerability (CVE-2026-14265) Analysis

Vulnerability Overview Java Deserialization Remote Code Execution (RCE) in AWS Advanced JDBC Wrapper via Cache Poisoning Vulnerability ID: CVE-2026-14265 Severity: High (CVSS v3 Base Score 7.9/10) Attack Vector: Network Attack Complexity: High Required Privileges: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High Affected Versions Affected Versions: >=3.3.0 AND <=4.0.0 Fixed Version: 4.0.1 Remediation Patch Version: 4.0.1 Temporary Mitigations: - Disable (not enabled by default). - Restrict write access to the Redis/Valkey cache infrastructure to trusted entities. Description AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends JDBC drivers to support Amazon Aurora and AWS Cloud features such as failover handling and caching. When the plugin is enabled, query results are read from a shared Redis/Valkey cache without class filtering. An attacker with write access to the cache can inject a carefully crafted serialized Java object, which, when read by the application, leads to arbitrary code execution on the application server. Workaround Temporary Mitigations: - Disable (not enabled by default). - Restrict write access to the Redis/Valkey cache infrastructure to trusted entities. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Required Privileges: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVSS v3 Vector String: Weakness: - CWE-502 --- Note: No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

AWS Advanced JDBC Wrapper Java Deserialization RCE Vulnerability (CVE-2026-14265) Analysis

More from this source