CVE-2026-94384

CVE Enrichment

CVSS: 6.4 MEDIUM
EPSS: 0.32%
EPSS Percentile: 22.79%
CISA KEV: Not listed

Description

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Published: 23-Sep-2026 01:17
Last Modified: 23-Sep-2026 02:16
EPSS Date: 2026-10-11
CWE: CWE-862

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:L /
                            VI:L /
                            VA:N /
                            SC:H /
                            SI:H /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 12-Oct-2026 04:51
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-18872, CVE-2026-17635, CVE-2026-17645, CVE-2026-18137 (IBM Financial Transaction Manager), CVE-2026-94384 (AWS Connect Salesforce Lambda), CVE-2026-65127, CVE-2026-65113, CVE-2026-65128, CVE-2026-65114, Weekly Security Recap: Exploited Citrix NetScaler Flaw and Dozens of Vulnerabilities

CVE (135)

Vendors (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.