AWS Security Bulletins: CVE-2026-85656 - OS command injection in Amazon log4j-cve-2021-44228-hotpatch
AWS Security Bulletins has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from AWS Security Bulletins.
- Review affected versions in the advisory.
- Apply updates promptly.
AWS Security Bulletins published a security advisory titled “CVE-2026-85656 - OS command injection in Amazon log4j-cve-2021-44228-hotpatch”.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2021-44228, CVE-2026-85656
What the advisory says
Bulletin ID: 2026-098-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/04/2026 10:30 AM PDT Description: log4j-cve-2021-44228-hotpatch is a tool which injects a Java agent into a running JVM process. The agent will attempt to patch the lookup() method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances to unconditionally return the string "Patched JndiLookup::lookup()". It is designed to address the CVE-2021-44228 remote code execution issue in Log4j without restarting the Java process. We identified CVE-2026-85656, an OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9.amzn2 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters. Impacted versions: <=1.3-8.amzn2 Please refer to the article
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CVE-2021-44228
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
