CVE-2026-122193: OS command injection in the example SSM documents in Trusted Remote Execution (REX)

Published Nov 6, 2026

Updated

OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.

To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Trusted Remote Execution (REX) Rex-RO and Rex-RW SSM documents from your environment.
Delete any Rex-RO and Rex-RW SSM documents created from the example script in each account and Region where the script was run.

Event History

Nov 6, 2026

CVE Published

via MITRE·05:09 PM

Data Sourced

via MITRE·05:09 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which environments are exposed?

Only accounts and Regions where the example provisioning script was run and created the Rex-RO or Rex-RW SSM documents are affected. Exposure also requires a managed instance and an authenticated remote user permitted to invoke one of those documents.

What level of access does an attacker need?

An attacker must be an authenticated remote user with permission to invoke the Rex-RO or Rex-RW SSM document. Successful exploitation can execute arbitrary commands as root on the managed instance and bypass Cedar policy enforcement.

What should be done if the example documents were deployed?

Delete any Rex-RO and Rex-RW SSM documents created from the example script. Perform this cleanup in every account and Region where the script was run.

How can I determine whether my environment is affected?

Review each account and Region for Rex-RO and Rex-RW SSM documents created by the example provisioning script. If neither document was created from that script, the described issue does not apply.

CVE-2026-122193: OS command injection in the example SSM documents in Trusted Remote Execution (REX)

Remediation

Event History

Frequently Asked Questions

Which environments are exposed?

What level of access does an attacker need?

What should be done if the example documents were deployed?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed?

What level of access does an attacker need?

What should be done if the example documents were deployed?

How can I determine whether my environment is affected?