Loading story…
Amazon disclosed CVE-2026-7461, an OS command injection flaw in the Amazon ECS Agent for Windows that can let a remote authenticated actor execute shell commands as SYSTEM on the underlying host. The vulnerability affects ECS agent versions 1.47.0 through 1.102.2 and stems from improper input validation during the mounting of FSx Windows File Server volumes, where a specially crafted username field in an ECS task definition can trigger command execution.
The issue is limited to ECS Windows worker instances and does not affect ECS on Fargate. Amazon said exploitation requires the ability to register ECS task definitions or to modify credentials in AWS Secrets Manager or SSM Parameter Store referenced by the FSx volume configuration. The company fixed the flaw in ECS agent version 1.103.0 and advised customers to upgrade to the latest ECS-optimized Windows AMI; as interim mitigations, AWS recommended restricting ecs:RegisterTaskDefinition permissions and limiting write access to the affected secrets.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
AWS published security bulletin AWS-2026-024 covering CVE-2026-7461, documenting the OS command injection issue in Amazon ECS Agent via FSx Windows File Server volume credentials. The bulletin formalized the vendor advisory for customers tracking AWS security notices.
Amazon fixed the vulnerability in Amazon ECS Agent version 1.103.0 and advised customers to upgrade to the latest Amazon ECS-optimized Windows AMI. AWS also recommended interim mitigations including restricting ecs:RegisterTaskDefinition permissions and limiting write access to referenced secrets in AWS Secrets Manager or SSM Parameter Store.
Amazon disclosed CVE-2026-7461, an OS command injection flaw in the Amazon ECS Agent for Windows affecting versions 1.47.0 through 1.102.2. The issue stems from improper input validation in FSx Windows File Server volume mounting and could allow a remote authenticated actor to execute commands as SYSTEM on ECS Windows worker instances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourceaws.amazon.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS disclosed **CVE-2026-6437**, a mount option injection vulnerability in the Amazon EFS CSI Driver that stems from insufficient input validation before user-controlled values are passed to the operating system's mount helper. In affected versions prior to `3.0.1`, Kubernetes `PersistentVolume` attributes including `mounttargetip` and `volumeHandle` can be crafted with injected comma-separated values that the Linux mount process interprets as additional mount options. Because the driver builds the mount option string directly from those fields and executes with elevated privileges on Kubernetes nodes, an attacker could cause unauthorized mount flags to be applied to the target EFS filesystem during the CSI driver's mount operation. The flaw affects environments using vulnerable EFS CSI Driver releases, and the reported remediation is to upgrade to version `3.0.1` or later.
Jun 29, 2026
A critical SSRF flaw in AWS Systems Manager (SSM) Agent, tracked as `CVE-2026-89049`, lets authenticated AWS users authorized to initiate remote-host port-forwarding sessions bypass protections blocking link-local destinations. By supplying alternate representations of denied addresses, an attacker can reach the EC2 Instance Metadata Service at `169.254.169.254` through the affected remote-host forwarding capability. Access to the metadata service could expose temporary credentials for the IAM role attached to the targeted EC2 instance, enabling further activity under that role's permissions. The issue affects SSM Agent versions earlier than `3.3.4851.0` and is fixed in version `3.3.4851.0`; organizations should update agents, restrict access to `AWS-StartPortForwardingSessionToRemoteHost`, tightly scope `ssm:StartSession`, and review Session Manager activity and EC2 instance-role usage.
Sep 14, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026