AWS trusted-remote-execution vulnerabilities

Latest AWS trusted-remote-execution CVEs

Newest publication first

1. CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)

   Published 2026-11-06

   Critical·CVSS 9.3 EPSS 1.6%

   OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed inst...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.