CVE-2026-85656
An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.
- Published Sep 4, 2026
- CVSS 8.5 high
- 1.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- CVE-2026-85656 - OS command injection in Amazon log4j-cve-2021-44228-hotpatch AWS Security Bulletins ·