CVE-2026-122193

Name of the Vulnerable Software and Affected Versions AWS Trusted Remote Execution (REX) versions prior to 2026-07-28

Description An OS command injection exists in the example SSM document provisioning script. An authenticated remote user with permissions to invoke the 'Rex-RO' or 'Rex-RW' SSM documents can execute arbitrary commands with root privileges on the managed instance, which allows the bypass of Cedar policy enforcement. Cedar is a policy language used to define and enforce permissions.

Recommendations Delete any 'Rex-RO' and 'Rex-RW' SSM documents created from the example script in every account and Region where it was executed.