CRITICALCVSS v3.1 9.9Vulnerability
CVE-2026-122193
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Cvss severity
- CRITICAL
- Cvss score
- 9.9
- Retrieved at
- 2026-11-07T06:41:39+00:00
- Score
- 9.9
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-122193
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- First seen by Signal
- 2026-11-06T18:25:35+00:00
- Name
- CVE-2026-122193
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Published at
- 2026-11-06T17:17:20.313
- Last modified
- 2026-11-06T21:17:07.030
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph