Amazon CloudFront CVE-2026-13762

Exploitation requires the target to be served through Amazon CloudFront WITH AWS WAF enabled AND a managed rule configured to perform request body inspection - without that WAF body-inspection deployment there is nothing to bypass. The attacker must also send HTTP/2 (not HTTP/1.1) requests and deliberately fragment the request body across multiple frames so only a partial body is inspected. Limiting factors: the bug only weakens a WAF protective layer, so actual harm depends on there being a real attack payload the WAF rules would otherwise block; the impact falls on the origin, not CloudFront; and because AWS remediated it fleet-wide server-side, the condition is no longer satisfiable on current infrastructure.

AWS's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, with no impact to the vulnerable system (VC:N/VI:N/VA:N) but HIGH subsequent-system impact (SC:H/SI:H/SA:H) - correctly modeling that the damage lands on the protected origin behind CloudFront, not CloudFront itself, yielding a 7.9 (High). There is no EPSS score, no KEV listing, and no POC referenced, so the practical risk is bounded: exploitation is conditional on the customer running AWS WAF with managed rule body inspection, and the real-world impact depends entirely on what attack the bypassed rules were stopping (e.g., SQLi/RCE payloads against the origin). Crucially, because AWS fixed this server-side across the fleet, the live risk to customers is effectively retired - the score reflects the pre-remediation potential, not an outstanding exposure. No conflicting signals were found, though the absence of EPSS/POC data means widespread exploitation was never demonstrated.

An attacker targeting a web application behind CloudFront+AWS WAF crafts an HTTP/2 request that splits a malicious payload (such as a SQL injection or command-injection string) across multiple DATA frames so the WAF inspects only a benign-looking partial body. The full body reassembles at the origin and executes the attack the managed rule was meant to block. No authentication or user interaction is required (PR:N/UI:N), and no public POC is known.