CVE-2026-115812

CRITICAL 9.8CVE-2026-115812 · Published 23/10/2026 · updated 23/10/2026

In short

CVE-2026-115812 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.53%, higher than 44.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.

References

aws.amazon.com/security/security-bulletins/2026-148-aws

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free