CVE-2026-122193: Critical command injection in AWS REX

CVE-2026-122193 identifies an OS command injection vulnerability in the example provisioning script for AWS Trusted Remote Execution (REX), version before 2026-07-28. The flaw exists in the Rex-RO and Rex-RW SSM documents generated by this script: an authenticated remote user with permission to invoke these documents can execute arbitrary commands as root on managed instances, bypassing Cedar access control policy enforcement.

The vulnerability carries a CVSS score of 9.9 (Critical). It was published in the NVD database on 2026-11-06 and is generating online traction: at least 11 posts on social media in the past 24 hours discuss the issue. No public exploits are reported in GitHub repositories, but the combination of maximum severity, impact on widely deployed AWS infrastructure, and recent disclosure makes immediate action urgent.

AWS teams must immediately identify and delete all Rex-RO and Rex-RW SSM documents that were created using the example script provided by AWS, in every account and every Region. It is necessary to check which versions of REX are currently in use and verify whether the provisioning was executed before the remediation date (2026-07-28). Once the affected documents are removed, risks from this vulnerability are eliminated.