analiza aiqbench
This critical SSRF vulnerability in the AWS Systems Manager Agent exposes sensitive link-local services, such as the EC2 Instance Metadata Service, by failing to validate equivalent address representations during port-forwarding sessions. While exploitation requires existing authenticated access, successful compromise allows attackers to retrieve IAM role credentials and pivot to broader AWS API operations if instance permissions are overly permissive. The issue is resolved in agent version 3.3.4851.0, necessitating immediate updates for environments relying on remote management features.
AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions
A critical vulnerability in the AWS Systems Manager Agent could let authenticated attackers bypass remote-host port-forwarding restrictions and access sensitive link-local services, including the Amazon EC2 Instance Metadata Service. The flaw, tracked as CVE-2026-89049, affects Amazon SSM Agent versions earlier than 3.3.4851.0 and has been fixed in version 3.3.4851.0. AWS Systems Manager Agent runs on […] The post AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions appeared first on Cyber Security News.
A critical vulnerability in the AWS Systems Manager Agent could let authenticated attackers bypass remote-host port-forwarding restrictions and access sensitive link-local services, including the Amazon EC2 Instance Metadata Service. The flaw, tracked as CVE-2026-89049, affects Amazon SSM Agent versions earlier than 3.3.4851.0 and has been fixed in version 3.3.4851.0.…
Extras afișat conform termenilor RSS ai publicației · 49 cuvinte · textul integral și figurile sunt pe site-ul publicației
Subiecte conexe
Weekly Cybersecurity Newsletter Bulletin – CrowdStrike Falcon, Chrome 0-Day, GPT-6 Astra, Dropbox Breach and 20+ Stories
Cybersecurity News · 7 sept. 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
CrowdStrike Blog · 13 oct. 2026
September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs
CrowdStrike Blog · 8 sept. 2026
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Cybersecurity News · 21 sept. 2026