Amazon patches critical 9.9 flaw in Neptune graph engine

Amazon fixed CVE-2026-110812 in the Neptune engine, where deserialization of untrusted data in the Gremlin graph import component let an authenticated user execute code and reach internal service credentials. The flaw scores 9.9 on CVSS 3.1, with fixes in versions 1.4.7.1, 1.4.8.1 and 1.5.0.0.

• CVSS 3.1 score is 9.9, CVSS 4.0 is 9.4, classes CWE-502 and CWE-918
• Affected range spans Neptune 1.2.0.0 up to below 1.5.0.0
• No public exploit exists; EPSS is 0.4% over 30 days
• ZoomEye found 547 public Gremlin services on port 8182