The vulnerability CVE-2026-19359 affects nxp-auto-goldvip gvip versions up to 1.4.0 due to improper access controls in the SitewiseCustomFunction of the Lambda Function Handler. This issue is caused by a historical IAM permission configuration error that allows remote exploitation. The vendor addressed the problem starting with version 1.13.0, with further permission updates in version 1.15.0. The vulnerability can be mitigated by upgrading to version 1.15.0 or later. Since the product is a cloud service, the vendor manages the remediation process, including requests to update or deprecate older versions in the AWS SAR application repository.

Improper access controls in the affected function could allow remote attackers to perform unauthorized actions within the Lambda Function Handler component. The CVSS 4.0 base score is 5.1 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no user interaction required. The vulnerability could lead to limited confidentiality, integrity, and availability impacts.

A fix is available by upgrading to nxp-auto-goldvip gvip version 1.15.0 or later. The vendor has addressed the IAM permission misconfiguration starting with version 1.13.0 and improved it in subsequent releases. Since this is a cloud service, the vendor manages remediation server-side. Users should verify they are running a version >=1.15.0 and consult the vendor advisory for any additional guidance. Older versions should be updated or deprecated as per vendor recommendations.