Threat Intelligence Database

CVE-2026-18061 is an XML External Entity (XXE) vulnerability in the AWS Advanced JDBC Wrapper's optional RemoteQueryCachePlugin. This plugin, when enabled with a shared cache, allows an actor with write access to insert crafted XML into cached column values. When the application reads these cached results as XML, external entities are resolved, potentially disclosing sensitive files accessible by the application process, including database and IAM role credentials. The vulnerability affects versions from 3.3.0 up to and including 4.2.0. It has been fixed in version 4.3.0. The plugin is not enabled by default, and mitigation includes disabling the plugin or restricting write access to the shared cache.

Bulletin ID: 2026-051-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:45 PM PDT Description: The AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends a JDBC driver to enable Amazon Aurora and AWS Cloud features such as failover handling and caching. We identified CVE-2026-14265, an issue in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When this plugin is enabled, query results read from the shared Redis/Valkey cache are deserialized without class filtering. An actor with write access to the shared cache infrastructure could insert a crafted serialized Java object that, when read by an application, results in execution of arbitrary code on the application server. Impacted versions: >=3.3.0 AND <=4.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.