7

Ask most people what database security means, and they’ll say passwords and access rules. Fair enough, but it’s only half of it. You can lock down logins perfectly and still be exposed if the engine underneath is running a vulnerable version.

On October 15, 2026, AWS published a notice about CVE-2026-110812, an Amazon Neptune Gremlin vulnerability. AWS has released patched engine versions and recommends that affected customers upgrade.

The CVE-2026-110812 fix is available in Neptune engine versions 1.4.7.1, 1.4.8.1, and 1.5.0.0. If you’re running Neptune, check your engine version and review who can send queries to your clusters.

You can find the details in the official AWS security bulletin.

What Is the Amazon Neptune Gremlin Vulnerability?

Neptune is Amazon’s managed graph database. Think social networks, “customers also bought” features, or tracing linked accounts in a fraud investigation—anywhere the connections between data points are the whole point. You query it with Gremlin, among other languages.

The bug is a deserialization problem in the Gremlin graph-import path. Deserialization means rebuilding incoming data into objects the software can use, and problems arise when that process handles untrusted input unsafely.

AWS says an authenticated principal with Neptune data-plane permissions could submit a request that causes the query engine to process input unsafely. A successful attempt could lead to unintended activity within the query engine environment.

The access that needs attention may belong to a service account created years ago or a developer role that still has query rights after a project ends. Alongside patching, review Neptune IAM permissions and check whether those users and services still need access.

Which Amazon Neptune Versions Are Affected and Patched?

AWS identifies affected releases starting at engine version 1.2.0.0 and lists the following releases as containing the fix.

Neptune engine line	Amazon Neptune patched versions
1.4.7	1.4.7.1
1.4.8	1.4.8.1
1.5.0	1.5.0.0

Which release you need depends on your current engine version and the supported upgrade path. Read the advisory and release notes before upgrading, especially if your cluster runs an older engine line.

For this issue, AWS says customers with automatic minor version upgrades enabled will receive the update during their next maintenance window. Customers who manage engine versions manually should schedule their upgrade.

Either way, don’t assume you’re already patched. Check what’s actually running across development, staging, and production.

How to Fix CVE-2026-110812 in Amazon Neptune

1. Check Your Amazon Neptune Engine Version

Before making changes, identify which clusters need attention.

If you’d rather skip the console, this AWS CLI command lists the clusters and engine versions in your configured AWS account and Region:

aws neptune describe-db-clusters
–query ‘DBClusters[*].[DBClusterIdentifier,EngineVersion]’
–output table

Repeat the check across every relevant AWS account and Region.

Match each version against the advisory, then keep a short list of clusters that need upgrading. It’s easy to forget a staging cluster that nobody has touched in months.

Record the cluster identifier, current engine version, intended target version, and planned maintenance window.

2. Plan Your Amazon Neptune Engine Upgrade

Start by creating a manual snapshot and confirming that it is available before proceeding.

Then work out which patched release matches your engine line and supported upgrade path. Read its release notes and run your real Gremlin queries against the target version on a test cluster. That’s where compatibility surprises should show up.

Production comes last. Choose a maintenance window that allows for a possible interruption, and coordinate the change with the teams responsible for applications using the database.

After the upgrade, confirm the cluster reports the intended version and your application works as expected. Follow AWS’s manual Neptune engine-upgrade instructions.

If you rely on Neptune auto minor version upgrade, check the setting, pending maintenance, and installed version rather than assuming the fix has already been applied.

For help coordinating updates across environments, SupportPRO’s AWS infrastructure management services cover patch management, backups, access management, and infrastructure maintenance.

3. Review Neptune IAM Permissions and Query Access

Patching is the priority, but take a close look at who can run queries while you’re at it.

Review IAM users and roles with Neptune data-plane permissions. Remove access that is no longer needed and limit neptune-db query permissions to trusted users and services that require them.

Pay particular attention to:

• Service accounts that applications no longer use.
• Developer roles with unnecessary production access.
• Permissions retained after projects or responsibilities change.
• Policies granting broader access than a workload requires.

While you’re waiting for the upgrade window, AWS recommends restricting query permissions to trusted principals. This reduces exposure, but upgrading to a patched engine version remains the recommended remediation.

For broader account-governance guidance, read our article on securing AWS Organizations against unauthorized account changes. It complements permission reviews across your wider AWS environment.

4. Verify the Upgrade and Document Changes

After patching, check the engine version again and run your usual application tests, paying particular attention to important graph queries.

Record:

• The cluster identifier and AWS Region.
• The engine versions before and after the upgrade.
• The upgrade date and application-test results.
• Any permission changes.
• Outstanding issues requiring follow-up.

Keep those records with your maintenance documentation so the next security review does not depend on someone remembering what happened.

For broader account-activity investigations, see Investigating AWS Security Incidents with CloudTrail for practical steps on reviewing account activity. CloudTrail should support your wider investigation; do not assume it provides a complete record of Neptune Gremlin queries.

Amazon Neptune Security Best Practices After Patching

Vulnerabilities don’t stop appearing after one upgrade. A few consistent habits make the next advisory easier to handle.

Stay on top of AWS security bulletins and review whether new advisories affect your environment. Keep an inventory of engine versions, identify pending maintenance, and assign responsibility for applying and verifying updates.

Limit query access to users and services that need it. Review permissions regularly, particularly after projects end or team responsibilities change.

Review the monitoring and logging available for your deployment, and investigate unexpected access or unusual application behavior. Keep a straightforward record of completed patches and unresolved security work.

Make AWS patch management part of a wider maintenance routine covering managed databases, operating systems, and supporting packages. For a separate example affecting Linux workloads, see our guide to the Amazon Linux 2 EFS utilities security update.

How SupportPRO Helps with AWS Infrastructure Management

When AWS publishes an advisory, the hard part is often figuring out what needs to change across your environment without disrupting running applications.

SupportPRO provides cloud infrastructure management and technical support, including maintenance and monitoring. For teams responding to a Neptune security advisory, support can include:

• AWS infrastructure reviews: Assess configurations and identify systems that need attention.
• AWS patch management: Plan updates and coordinate changes across environments.
• Access-control reviews: Check permissions and work toward least privilege.
• Cloud monitoring and maintenance: Maintain visibility into infrastructure health and reliability.
• DevOps support: Help teams test and coordinate infrastructure changes.

SupportPRO’s cloud management services help businesses maintain cloud environments through infrastructure monitoring, security updates, and ongoing operational support.

If you use Neptune, checking engine versions and query permissions is a practical starting point. SupportPRO can help incorporate those checks into your wider AWS maintenance plan.

Conclusion

The Amazon Neptune vulnerability affecting Gremlin functionality reminds us that managed databases still require security reviews and timely updates.

To address CVE-2026-110812, identify affected clusters, upgrade through a supported path to a patched engine version, and verify application behavior afterward. Review query permissions alongside the upgrade and retain a clear record of the changes.