CVE-2026-85656 — OS command injection in Amazon log4j-cve-2021-44228-hotpatch

Back Back to CVE browser

HIGH

OS command injection in Amazon log4j-cve-2021-44228-hotpatch

Published Sep 4, 2026

8.5

HIGH

CVSS 4.0

EPSS 1.08%

Description

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Affected products

Vendor Amazon Product Log4j-Cve-2021-44228-Hotpatch Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.3-9.amzn2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Amazon

Log4j-Cve-2021-44228-Hotpatch

unaffected

Version	Status	Constraints
0	affected	<1.3-9.amzn2

Remediation

No remediation recorded yet.

Metrics

1.08% 0.01081

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01081

Score over time

Sep–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.08% (0.01081)	63.96th	v5 (v2026.06.15)
Sep 5, 2026	1.12% (0.01121)	63.54th	v5 (v2026.06.15)

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://alas.aws.amazon.com/AL2/ALAS2-2026-3784.html
vendor-advisorypatchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-098-aws/
vendor-advisory

Link	Providers	Tags
https://alas.aws.amazon.com/AL2/ALAS2-2026-3784.html		vendor-advisorypatchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-098-aws/		vendor-advisory