TI-2026-58769 Aliases CVE-2026-85656 GHSA-4p2r-rwww-hrf2

OS command injection in Amazon log4j-cve-2021-44228-hotpatch

MEDIUM 41CWE-78Published 2026-09-04 · Updated 2026-09-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01081 65th percentileScored 2026-11-07

Fix Fixed log4j-cve-2021-44228-hotpatch (Amazon): 1.3-9.amzn2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AWS	log4j-cve-2021-44228-hotpatch	before 1.3-9.amzn2	1.3-9.amzn2	Patch available	CNA

log4j-cve-2021-44228-hotpatch VendorAWS Affected before 1.3-9.amzn2 Fixed in 1.3-9.amzn2 Patch available CNA

Remediation

Fix · CNA log4j-cve-2021-44228-hotpatch (Amazon) Fixed in 1.3-9.amzn2

Timeline

2026-10-02 Threatist record created from CVE-2026-85656
2026-10-03 Alias added: GHSA-4p2r-rwww-hrf2

References

Patch 1

https://alas.aws.amazon.com/AL2/ALAS2-2026-3784.html

Advisory 1

https://aws.amazon.com/security/security-bulletins/2026-098-aws/

TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9

See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences