AWS Patches Remote Code Execution Flaw in Advanced JDBC Wrapper

AWS released version 4.0.1 of its Advanced JDBC Wrapper on July 1, 2026, to fix a remote code execution vulnerability. The advisory, identified as CVE-2026-14265, warns that the flaw could allow attackers to run arbitrary code on application servers by manipulating cached data.

The vulnerability resides in the RemoteQueryCachePlugin component of the wrapper. According to the AWS Security Bulletin, this plugin enables features like failover handling and caching for Amazon Aurora and other AWS services. When the plugin is active, it reads query results from a shared Redis or Valkey cache. The system deserializes these results without applying class filtering, creating a security gap.

Technical Details of the Flaw

An attacker with write access to the shared cache infrastructure could exploit this lack of filtering. By inserting a crafted serialized Java object into the cache, the attacker can trigger malicious actions. When an application reads the compromised data, it deserializes the object, leading to the execution of arbitrary code on the server.

The RemoteQueryCachePlugin is not enabled by default in the AWS Advanced JDBC Wrapper. This reduces the immediate risk for users who have not explicitly configured the wrapper to use remote query caching. However, any environment with the plugin active and connected to a writable cache is potentially vulnerable until patched.

Affected Systems and Mitigation

AWS rates this bulletin as important and requires attention from customers using the wrapper. The advisory specifically targets users of the open-source JDBC driver wrapper who have enabled the RemoteQueryCachePlugin. Organizations relying on Amazon Aurora or other AWS Cloud features through this wrapper should verify their configurations immediately.

Customers who cannot upgrade to version 4.0.1 immediately have two mitigation options. First, they can disable the RemoteQueryCachePlugin entirely. Second, they should restrict write access to the underlying Redis or Valkey cache infrastructure to trusted principals only. These steps prevent untrusted actors from injecting malicious serialized objects into the cache.

What should you do?

AWS recommends upgrading to version 4.0.1 of the Advanced JDBC Wrapper to incorporate the new fixes. Users who have forked or derived code from the wrapper must also patch their versions to include these security improvements. Disabling the plugin serves as a temporary workaround for those unable to update right away.

What to do and how to stay safe: AWS

• Check if your applications use the AWS Advanced JDBC Wrapper and whether the RemoteQueryCachePlugin is enabled.
• Upgrade to version 4.0.1 or later to apply the official patch for CVE-2026-14265.
• If immediate upgrading is not possible, disable the RemoteQueryCachePlugin in your configuration.
• Restrict write access to your Redis or Valkey cache infrastructure to trusted principals only.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-14265?

It is a deserialization of untrusted data vulnerability in the AWS Advanced JDBC Wrapper’s RemoteQueryCachePlugin that allows arbitrary code execution.

How can an attacker exploit this flaw?

An attacker with write access to the shared cache can insert a crafted serialized Java object, which executes arbitrary code when read by the application.

Is the RemoteQueryCachePlugin enabled by default?

No, the RemoteQueryCachePlugin is not enabled by default in the AWS Advanced JDBC Wrapper.