CVE-2026-115812

LOWCVSS 9.3 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://aws.amazon.com/security/security-bulletins/2026-148-aws/

Weakness type (CWE)

CWE-23

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Parameter Watch@ParameterWatch19h
⚠️ CVE-2026-115812 (9.8) ⚠️ AWS Multi Model Server, the model serving tool, could let anyone run commands on the server with a crafted model archive. Multi Model Server 1.1.11 and earlier is affected. It is end of life with no fix, so move to a supported model server. https://t.co/o0A15hC1wn
2001071
14 followersView on X

Explore more

Back to dashboard