Which versions of AWS JDBC Wrapper are affected by CVE-2026-14265?

AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 contain an arbitrary code execution vulnerability in the RemoteQueryCachePlugin's unsafe deserialization of cached query results from Redis or…. A patch is available.

How to fix or mitigate CVE-2026-14265?

Within 24 hours: Identify all applications using AWS Advanced JDBC Wrapper versions 3.3.0-4.0.0 and audit their Redis/Valkey cache access controls. Within 7 days: Deploy the available vendor patch to all affected application servers; verify successful upgrade to patched version. Within 30 days: Conduct full cache access control audit; restrict write permissions to trusted processes only and implement integrity monitoring.

AWS JDBC Wrapper CVE-2026-14265

Q: What is the CVSS score of CVE-2026-14265?

CVE-2026-14265 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41132 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-01 AMZN

Deserialization Java Redis RCE Aws Advanced Jdbc Wrapper

7.7

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable cache read but requires attacker cache-write foothold plus a viable gadget chain, so AC:H and PR:L; full CIA impact within the app process yields C/I/A:H and S:U.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 20:28 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 01, 2026 - 20:27 vuln.today

Analysis Updated

Jul 01, 2026 - 20:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 01, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 01, 2026 - 20:22 NVD

7.5 (HIGH) 7.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 20:16 vuln.today

CVE Published

Jul 01, 2026 - 19:34 cve.org

HIGH 7.5

DescriptionCVE.org

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned.

We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

Articles & Coverage 1

News 3 New Java Vulnerabilities - 3 High Severity, No Active Exploits Jul 02, 2026

AnalysisAI

Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.

Technical ContextAI

The AWS Advanced JDBC Wrapper is a Java JDBC driver shim that layers connection management, failover, and caching plugins over an underlying database driver. The RemoteQueryCachePlugin stores and retrieves query results in an external Redis/Valkey cache so multiple application instances can share cached results. Per CWE-502 (Deserialization of Untrusted Data), the root cause is the use of java.io.ObjectInputStream.readObject() against attacker-influenceable bytes without an allow-list (e.g., ObjectInputFilter/setObjectInputFilter). Because Redis/Valkey stores the serialized Java objects verbatim, any writer to that cache controls the byte stream that gets deserialized, and if a known gadget chain (e.g., from commons-collections or similar libraries on the classpath) is present, deserialization becomes remote code execution. The affected component is identified by cpe:2.3:a:aws:aws_advanced_jdbc_wrapper.

RemediationAI

Vendor-released patch: upgrade to AWS Advanced JDBC Wrapper version 4.0.1 or later (release: https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1), which is the primary and recommended fix. If you cannot upgrade immediately, disable the RemoteQueryCachePlugin (or switch to a local/in-memory cache that is not shared or externally writable) to remove the untrusted deserialization path, accepting the trade-off of losing shared cross-instance query caching. Additionally, restrict and authenticate the Redis/Valkey cache so only trusted application servers can write to it (enable AUTH/ACLs, bind to private subnets, enforce TLS, and block the cache port from untrusted networks) - this reduces the attacker's ability to poison entries but does not by itself close the class-filtering gap, so patching remains required. Track fix details via the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-051-aws/) and GHSA-c5q4-97jw-jggh.