Vulnerability · 1 source · latest 3h

AWS warns of remote code execution flaw in Amazon Redshift JDBC driver

VULNERABILITYCVE-2026-119084redteam/daily · 1 source

Severity: High
Highest CVSS: 9.2
Exploited: Not known
Sources: 1

What happened

CVE-2026-119084 (AWS bulletin 2026-168-AWS) affects Amazon Redshift JDBC Driver versions prior to 2.3.0. Under certain conditions, the driver loads and executes arbitrary classes when processing JDBC connection URL parameters or AWS credentials profile fields, resulting in remote code execution. Defenders should upgrade to Amazon Redshift JDBC Driver 2.3.0 or later and identify applications that embed earlier versions.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Update the Amazon Redshift JDBC Driver to version 2.3.0 or later.
Check which applications and systems use a Redshift JDBC driver version earlier than 2.3.0.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-119084CVSS 9.2Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins