amazon-ssm-agent vulnerabilities

Latest amazon-ssm-agent CVEs

Newest publication first

1. CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

   Published 2026-08-28

   High·CVSS 8.7 EPSS 0.90%

   Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary file...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.