CVE-2026-85656

Published Sep 4, 2026

Last updated 2 days ago

CVSS high 8.5
AWS

Overview

Description
An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
8.5
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

ff89ba41-3aa1-4d27-914a-91399e9639e5
CWE-78

Social media

Hype score
Not currently trending

  1. CVE-2026-85656: OS command injection in Amazon Linux's log4j hotpatch package (<1.3-9). Local user can execute arbitrary commands as root via crafted Java process path with newlines. CVSS 7.8. Unpatched! If you rely on this https://t.co/ElQC375yfp #CVE #valtersit #CVEAlert

    @HugoValters

    8 Sept 2026

    40 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️ Vulnerabilidad en productos Amazon ❗ CVE-2026-85656 ➡️ Más info: https://t.co/0uFhchzqgH https://t.co/m5yoInqvWW

    @CERTpy

    7 Sept 2026

    220 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. AWS says CVE-2026-85656 affects the Amazon Linux Log4j hotpatch through 1.3-8.amzn2; update affected AL2 hosts to 1.3-9.amzn2 or later. https://t.co/WP5ug5d9Vm

    @AiCybr_

    6 Sept 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨High - Amazon Linux log4j hotpatch Root Command Injection via Newline Path (CVE-2026-85656) Amazon Linux log4j-cve-2021-44228-hotpatch < 1.3-9.amzn2 mishandles Java executable paths containing embedded newline characters, enabling OS command injection during hotpatch hand

    @UpwindMDR

    5 Sept 2026

    210 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2024-31884
  2. Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.•CVE-2026-84942
  3. An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or above.•CVE-2026-85787
  4. Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.•CVE-2026-85786
  5. Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.•CVE-2026-85781

References

Sources include official advisories and independent security research.