Amazon SSM Agent CVE-2026-81849

Exploitation requires the attacker to hold valid AWS IAM credentials with the ssm:SendCommand permission, specifically when that permission is scoped or restricted to the AWS-DownloadContent SSM document type - a common least-privilege IAM configuration for content delivery automation. The attacker must also control an S3 bucket (or an S3 object path within a bucket) that they can direct the SSM document to retrieve from, and must be able to create S3 objects with key names embedding path traversal sequences. Unauthenticated internet access alone is not sufficient - a valid AWS API session is required. Exploitation is limited to instances running amazon-ssm-agent versions before 3.3.4515.0 with the aws:downloadContent plugin active. No user interaction on the target instance is required once the SSM command is issued. The primary limiting factor is the requirement for prior AWS credential compromise; the vulnerability does not enable initial access but amplifies the impact of a credential breach.

The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the high potential impact but slightly understates the attack prerequisites. PR:L correctly captures that valid AWS IAM credentials with ssm:SendCommand permission are required - this is not unauthenticated internet exposure, and the attack surface is bounded to environments where an adversary already holds AWS credentials. The AC:L assessment from the vendor implies that once prerequisites are met, crafting the traversal payload is straightforward, which is consistent with the nature of path traversal bugs. No EPSS data was provided, preventing quantitative exploitation probability assessment. No CISA KEV listing and no public POC exist in the provided data, tempering urgency compared to actively exploited vulnerabilities. Real-world risk is highest for organizations where developer or service IAM roles have ssm:SendCommand scoped to AWS-DownloadContent - a common pattern in CI/CD pipelines - since those credentials represent a viable attacker foothold. The root-write primitive is particularly dangerous because it can target cron jobs, SSH authorized_keys, sudoers, or PAM configuration without requiring any additional privilege escalation step.

An attacker who obtains AWS IAM credentials with ssm:SendCommand permission scoped to the AWS-DownloadContent document - for example via a phished developer, a leaked CI/CD service account key, or a compromised Lambda execution role - uploads a malicious file to an S3 bucket under their control using a key name containing path traversal sequences such as '../../etc/cron.d/pwned'. They issue an SSM RunCommand targeting one or more managed instances, directing AWS-DownloadContent to retrieve from their malicious bucket. The SSM agent on each target writes the file to /etc/cron.d/pwned as root, executing an attacker-controlled cron job on the next scheduled run and establishing persistent root-level access to the fleet.