CVE-2026-7461

{
  "id": "CVE-2026-7461",
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "published": "2026-04-30T19:16:10.737",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username field in an ECS task definition. This issue requires permissions to register ECS task definitions or write to the Secrets Manager or SSM Parameter Store credentials used by the FSx volume configuration.\n\nTo remediate this issue, users should upgrade to version 1.103.0."
    },
    {
      "lang": "es",
      "value": "La neutralización incorrecta de entradas utilizadas en un comando del sistema operativo en el componente de montaje de volumen de FSx Windows Servidor de Archivos en el Agente de Amazon ECS en Windows antes de la versión 1.103.0 podría permitir a un actor de amenaza remoto autenticado ejecutar comandos de shell con privilegios SYSTEM en el host subyacente a través de un campo de nombre de usuario especialmente diseñado en una definición de tarea de ECS. Este problema requiere permisos para registrar definiciones de tareas de ECS o escribir en las credenciales de Secrets Manager o SSM Parameter Store utilizadas por la configuración de volumen de FSx.\n\nPara remediar este problema, los usuarios deben actualizar a la versión 1.103.0."
    }
  ],
  "affected": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "affectedData": [
        {
          "vendor": "AWS",
          "product": "Amazon ECS Agent",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "1.47.0",
              "lessThanOrEqual": "1.102.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-30T00:00:00+00:00",
          "id": "CVE-2026-7461",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:amazon:amazon_ecs_container_agent:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.47.0",
              "versionEndExcluding": "1.103.0",
              "matchCriteriaId": "11C9BCEC-F7E3-4E82-B43E-59D82E4CEA52"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://aws.amazon.com/security/security-bulletins/2026-024-aws/",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/aws/amazon-ecs-agent/releases/tag/v1.103.0",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-fc67-c4hg-q653",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}