DEV Community

Why Nobody Has Exploited CVE-2026-110812 Yet, and Why That Should Not Set Your Timeline

A 9.9 with no public proof of concept and an EPSS of 0.4 percent is the kind of advisory that lands in a backlog.

The reasoning is understandable and, for this specific flaw, partly correct. It is also fragile in a way worth spelling out.

The facts on the record

Amazon assigned CVE-2026-110812 on 15 October 2026 for deserialization of untrusted data in the Gremlin graph data import component of Amazon Neptune engine, with CWE-502 and CWE-918 as the listed weakness classes.

An authenticated remote actor holding standard database permissions may execute arbitrary code and reach internal service credentials. CVSS 3.1 is 9.9; CVSS 4.0 is 9.4.

Affected range is 1.2.0.0 up to below 1.5.0.0, with fixes in 1.4.7.1, 1.4.8.1 and 1.5.0.0.

No public exploit exists. No in-the-wild use has been confirmed.

Why the low likelihood is genuine

The EPSS estimate of 0.4 percent over 30 days is not a placeholder. It reflects the authentication requirement and the fact that Neptune clusters are normally unreachable from the internet.

An attacker needs a foothold that already grants query permission before the flaw matters, and that foothold is the harder part of the operation.

For organisations whose clusters are correctly private and whose query credentials are tightly held, the practical risk this month is small. Saying so honestly is better than inflating every critical score into a crisis.

Why the timeline should not follow the EPSS number

Three structural reasons argue against waiting.

  1. Deserialization flaws move from advisory to exploit once a researcher publishes a chain, and chains for Java-based graph engines are a well-developed research area. The absence of a public payload today is a statement about publication, not about difficulty.
  2. The authentication barrier changes shape with cloud adoption. A query credential in a notebook, a shared test key, or an over-broad service role collapses PR:L to something closer to unauthenticated from the attacker's perspective inside an account. Credential hygiene at scale tends to degrade, not improve, across a quarter.
  3. The flaw's stated payoff includes internal service credentials. That is a persistence multiplier. A flaw that only read graph data would rank differently in a queue than one whose success hands over credentials trusted elsewhere.

What the exposure numbers do and do not add

ZoomEye returned 547 assets for http.body="gremlin" && port="8182" on 27 October 2026. That figure describes Gremlin services reachable on the public internet.

It is not a count of vulnerable Neptune clusters, and it does not change the exploitation assessment.

Its one relevant contribution is scale context: Gremlin interfaces do appear on public addresses in the hundreds. Each of those is a query endpoint whose authentication model deserves a look, independent of this advisory.

A defensible prioritisation

The reasonable position sits between panic and postponement. Patch affected clusters to 1.5.0.0, or to 1.4.8.1 and 1.4.7.1 where the newest minor is blocked.

Treat clusters with automatic minor version upgrade enabled as already scheduled and confirm the window; treat the rest as work with an owner and a date.

Until patched, restrict neptune-db query permissions to trusted principals, as AWS advises, and shorten credential lifetimes for whatever remains.

Then use the interval to answer a question that outlives the CVE: which principals in this account can reach a graph import path, and does anyone review that list.

If the answer is that nobody reviews it, the flaw is not the finding. The finding is the access model, and it will still be there when the next advisory arrives.

References

Read on DEV Community ↗ ← Back to News

Comments

No comments yet. Start the discussion.