CVE-2026-14265
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A deserialization vulnerability in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 allows arbitrary code execution via untrusted data from Redis or Valkey cache. An attacker with write access to the shared cache infrastructure can inject a crafted Java object that, when read by the application server, triggers code execution.
Risk Assessment
The risk includes remote code execution on application servers, potentially leading to system compromise, data theft, or lateral movement within the internal network.
Recommendation
Upgrade AWS Advanced JDBC Wrapper to version 4.0.1 or later, which fixes the vulnerability by adding class filtering during deserialization.
Other vulnerabilities in AWS Advanced JDBC Wrapper
Original NVD description (English source)
Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS