CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122193?
CVE-2026-122193 is a critical vulnerability in AWS trusted-remote-execution, published on 6 Nov 2026.
Official description
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.
To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.
Weakness: CWE-78
Which versions are affected by CVE-2026-122193?
How do I fix CVE-2026-122193?
No fix has been published for CVE-2026-122193 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122193 being exploited?
There is no known exploitation of CVE-2026-122193 in the wild and no public exploit code.