{"vulnerability": "CVE-2026-7461", "sightings": [{"uuid": "40eaad27-cef8-4d5f-8c14-fad2c702c082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7461", "type": "seen", "source": "https://gist.github.com/alon710/685bd82e2bb849307786205498652c75", "content": "# GHSA-FC67-C4HG-Q653: CVE-2026-7461: OS Command Injection in Amazon ECS Agent for Windows via FSx Volume Credentials\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/GHSA-FC67-C4HG-Q653\n\n## Summary\nA high-severity OS command injection vulnerability exists in the Amazon ECS Agent for Windows (versions 1.47.0 to 1.102.0) that permits an authenticated attacker with task definition creation privileges to execute arbitrary commands as the SYSTEM user via crafted FSx Windows File Server volume credentials.\n\n## TL;DR\nThe Amazon ECS Agent for Windows improperly neutralizes user input when mounting FSx Windows File Server volumes. Attackers with task definition privileges can inject shell metacharacters into the username field, leading to OS command execution as SYSTEM. Administrators must upgrade to version 1.103.0.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: OS Command Injection\n- **CWE ID**: CWE-78\n- **CVSS v3.1 Base Score**: 7.2 (High)\n- **Attack Vector**: Network\n- **Privileges Required**: High (Task Definition Registration)\n- **Impact**: SYSTEM-level Arbitrary Code Execution\n- **Exploit Maturity**: Proof of Concept\n- **Fixed Version**: 1.103.0\n\n## Affected Systems\n\n- Amazon ECS Agent (Windows)\n- Amazon FSx for Windows File Server Integration\n- **Amazon ECS Agent (Windows)**: >= 1.47.0, < 1.103.0 (Fixed in: `1.103.0`)\n\n## Mitigation\n\n- Upgrade the Amazon ECS Agent to version 1.103.0 or later on all Windows instances.\n- Audit and enforce least privilege IAM policies for 'ecs:RegisterTaskDefinition' and 'ecs:RunTask' actions.\n- Implement CloudTrail monitoring to detect shell metacharacters in volume configuration credential fields.\n\n**Remediation Steps:**\n1. Open an administrative PowerShell session on the target Windows container instance.\n2. Stop the ECS service using the command: Stop-Service -Name \"ecs\".\n3. Download the latest agent zip file using: Invoke-WebRequest -Uri https://s3.us-east-1.amazonaws.com/amazon-ecs-agent-us-east-1/amazon-ecs-agent-latest.zip -OutFile agent.zip.\n4. Extract the archive using: Expand-Archive -Path agent.zip -DestinationPath .\n5. Verify the version using: ./amazon-ecs-agent.exe -version.\n6. Restart the ECS service using: Start-Service -Name \"ecs\".\n\n## References\n\n- [AWS Security Bulletin 2026-024-aws](https://aws.amazon.com/security/security-bulletins/2026-024-aws/)\n- [GitHub Advisory: GHSA-fc67-c4hg-q653](https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-fc67-c4hg-q653)\n- [NVD Vulnerability Detail: CVE-2026-7461](https://nvd.nist.gov/vuln/detail/CVE-2026-7461)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FC67-C4HG-Q653) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-07T01:40:29.000000Z"}, {"uuid": "c6155a26-96aa-4058-a168-4229d8d53465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7461", "type": "seen", "source": "https://bsky.app/profile/securitycipher.bsky.social/post/3mle4disudb2h", "content": "Zero-Day to SYSTEM (RCE): Escaping AWS ECS Containers via OS Command Injection CVE-2026\u20137461\n\nhttps://medium.com/@sachinpatilsp/zero-day-to-system-escaping-aws-ecs-containers-via-os-command-injection-cve-2026-7461-3d44f5f367e8?source=rss------bug_bounty-5", "creation_timestamp": "2026-05-08T16:06:05.320067Z"}, {"uuid": "ff04145e-6056-47c1-81e5-a1128de75883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74616", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117140093269733593", "content": "A new vulnerability with increased severity was disclosed for Linux Kernel (CVE-2026-74616) https://vuldb.com/vuln/394392", "creation_timestamp": "2026-08-22T16:26:14.390150Z"}, {"uuid": "8253a3c8-e1a2-4b06-89ea-b0d447104a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74611", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtv7jqnrs725", "content": "CVE-2026-74611 - linux\nThe Linux operating system\u2019s core code that processes encrypted network traffic can mistakenly write data into the wrong memory area when a certain TLS 1.3 feature is used. This could cause\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #CVE #infosec", "creation_timestamp": "2026-08-25T06:40:04.730130Z"}, {"uuid": "10cd55b9-26d2-454a-bea0-0f9c6452e62f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74612", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtv7jrzsu72p", "content": "CVE-2026-74612 - linux\nThe virtual Ethernet (veth) driver in Linux could miscalculate packet sizes after certain packet processing, causing it to copy extra data\u2014including internal kernel pointers\u2014into user\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #CVE #infosec", "creation_timestamp": "2026-08-25T06:40:06.425323Z"}, {"uuid": "45c909a5-7fc5-403a-b860-5c88fc2cb975", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74616", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtva3mpymf2j", "content": "CVE-2026-74616 - linux\nA bug in the Linux kernel's XDP feature could let specially crafted network traffic overwrite important packet information, potentially causing network services to behave incorrectly. The problem\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #CVE #infosec", "creation_timestamp": "2026-08-25T06:50:04.535785Z"}, {"uuid": "7df8e744-24cd-43d8-b535-31f73f28bcce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74617", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtva3of3hg2c", "content": "CVE-2026-74617 - linux\nA part of the Linux operating system that communicates with certain hardware devices could start processing signals before it is fully set up, which may cause the system to freeze or crash.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #CVE #infosec", "creation_timestamp": "2026-08-25T06:50:06.380486Z"}]}