AWS Advanced JDBC Wrapper CVE-2026-18061

Exploitation requires three specific conditions to be met simultaneously. First, the RemoteQueryCachePlugin must be explicitly enabled in the JDBC wrapper configuration - it is an opt-in plugin, not active by default. Second, the application must execute queries that return XML-typed columns (SQLXML), which the plugin will serialize into the cache. Third, the attacker must have write access to the shared cache infrastructure (PR:L in the CVSS vector); this limits the attack to scenarios where the cache is multi-tenant, accessible from a compromised component, or misconfigured with open write permissions. What limits exploitation beyond these prerequisites: the attack produces confidentiality impact only (no code execution on the database host from the XXE alone), is constrained to files readable by the application process user, and requires the attacker to also be able to observe or retrieve the exfiltrated file content after injection.

The supplied CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L) encodes a moderate-to-medium real-world risk: AC:H correctly reflects that the attacker must first achieve write access to the shared cache (a significant prerequisite), and PR:L confirms some level of privilege is needed. Despite C:H (full confidentiality loss of targeted files, including AWS IAM credentials), the combination of AC:H and PR:L brings the base score to 5.9 - a reasonable assessment. The A:L metric is not clearly supported by the description, which focuses exclusively on information disclosure; this may represent malformed XML triggering parse errors, but it is not independently confirmed. No public exploit code has been identified and the vulnerability is not in the CISA KEV catalog, suggesting no known active exploitation. The primary real-world concern is the sensitivity of what can be exfiltrated: IAM role credentials from EC2 instance metadata or database credential files would allow lateral movement within an AWS account, making the effective downstream impact materially higher than the base score implies. Organizations using the RemoteQueryCachePlugin with XML column types on externally-accessible or multi-tenant cache infrastructure should treat this as a higher practical priority than the 5.9 score alone suggests.

An attacker who has obtained write access to the shared Redis or Memcached instance used by the application - for example, via a compromised microservice, misconfigured cache ACLs, or a separate vulnerability - injects a crafted XML payload into a cached column value: the payload contains a DOCTYPE with a SYSTEM external entity referencing a sensitive local path such as the EC2 instance metadata endpoint or a credential file on disk. When a legitimate application thread reads the poisoned cached result and deserializes the SQLXML column, the Java XML parser resolves the external entity and returns the file contents, which are then accessible to the attacker through subsequent cache reads or application behavior. No public proof-of-concept has been identified at time of analysis.