CVE-2026-94384Patch

☁️🚨 AWS DISCLOSES AMAZON CONNECT–SALESFORCE PRIVILEGE-ESCALATION FLAW — LAMBDA CAN BYPASS CALLER IAM RESTRICTIONS AWS has disclosed CVE-2026-94384, a newly published authorization vulnerability in the Amazon Connect Salesforce integration that can let a lower-privileged AWS identity use a setup Lambda as a confused deputy to perform AWS API operations its own IAM policy explicitly denies. • CVE-2026-94384 — CVSS 8.1 High • Affects Amazon Connect Salesforce Lambda versions 5.15 through 5.24.16 • The vulnerable sfExecuteAWSService Lambda accepts caller-supplied parameters and dispatches them to privileged AWS service APIs without validating whether the caller is authorized for the requested operation • Any IAM principal with lambda:InvokeFunction permission on that function can potentially cross its intended IAM permission boundary • Impact includes unauthorized access to or modification of AWS resources reachable through the Lambda’s execution role • The vulnerable function is intended only for initial setup and is disabled by default — exposure therefore depends on deployment configuration • AWS recommends upgrading to version 5.26+, then deleting or disabling sfExecuteAWSService; if it must remain enabled, invocation should be restricted to the intended IAM user only • No confirmed in-the-wild exploitation or public exploit has been identified at this time ⚠️ Analyst Note: The interesting cloud-security issue is the privilege-boundary bypass. An identity can be correctly denied an AWS API action by IAM, yet still reach that action indirectly if it is allowed to invoke a more privileged Lambda that fails to re-authorize the requested operation. Organizations using the Amazon Connect–Salesforce integration should check not only package version but whether this setup function was left enabled and who currently has permission to invoke it. Original AWS security bulletin: https://aws.amazon.com/security/security-bulletins/2026-115-aws/ Original GitHub security advisory: https://github.com/amazon-connect/amazon-connect-salesforce-cti/security/advisories/GHSA-c9j2-qjfv-mm4p #AWS #AmazonConnect #Salesforce #CVE202694384 #CloudSecurity #IAM #PrivilegeEscalation #ThreatIntel #DDW #DarkWeb

【対象】 AmazonConnectSalesforceLambda (Amazon Connect Salesforce Lambda package) 【影響バージョン】 v5.15 〜 5.24.16 【脆弱性】 CVE-2026-94384(sfExecuteAWSService 関数の認可欠如、CVSS 8.1) 【修正版】 v5.26 (しかし現在最新がv5.28で認証方法が変更されているため最新を推奨) http://github.com/amazon-connect… 【注意点】 ・既にインストール済みの方はAWS Serverless Application Repositoryからのインストールとなるため、手動アップデート必須 ・パッケージ内のsfExecuteAWSService Lambdaは利用しない場合は削除または無効化を推奨。 とのこと。 by アマコネ芸人

AWS corrigió la vulnerabilidad de alta severidad CVE-2026-94384 en el paquete de integración AmazonConnectSalesforceLambda. El fallo en la función sfExecuteAWSService permite a usuarios con permisos básicos de invocación evadir sus restricciones de IAM y ejecutar acciones privilegiadas en la nube utilizando el rol de ejecución de la Lambda. AWS recomienda actualizar a la versión 5.26 o deshabilitar la función tras completar la configuración inicial.

☁️ AWS IAM ESCALATION: Critical flaw in AWS Connect Salesforce Lambda (CVE-2026-94384, CVSS 9.1)! Missing auth checks let low-privileged users escalate to full AWS account Administrator. 👉 Deep dive: https://sh3llc0d3.com/blog/aws-connect-salesforce-flaw-how-open-source-lambda-packages-allowed-iam-account-takeover-cve-2026-94384/ #sh3llc0d3 #shellcode #AWS #CloudSecurity

AWS の脆弱性 CVE-2026-94384 が FIX：Lambda 関数による IAM バイパスの恐れ https://iototsecnews.jp/2026/09/23/aws-lambda-flaw-lets-attackers-bypass-iam-permissions-and-access-cloud-services/ この記事は、Amazon Connect Salesforce Lambda アプリケーションにおける検証不備の不具合を解説しています。関数実行時に呼び出し元の権限確認を行わない点が問題の背景であり、悪用されると権限の低い主体が本来許可されないクラウド操作を実行できる恐れが生じます。影響として権限昇格による不正な操作が行われる可能性が考えられます。対応策としては、修正版であるバージョン 5.26 へアップグレードした上で、設定完了後に不要となった該当関数の無効化／呼び出し権限の最小化／関連設定やログの精査により、予期せぬ悪用の調査が求められます。 #AWS #CVE202694384 #Vulnerability

🔐 セキュリティトレンド (08:44 JST) ① 実行犯が示唆したダークウェブでの情報公開は確認されず ～ ワシントンホテルにランサムウェア ... https://s.netsecurity.ne.jp/article/2026/09/25/56299.html ② AWS、Amazon ConnectとSalesforce連携に権限昇格の脆弱性 CVE-2026-94384 Lambda経由 ... https://rocket-boys.co.jp/security-measures-lab/aws-amazon-connect-salesforce-cve-2026-94384/ ③ ペネトレーションテストと脆弱性診断の違い｜目的・手法・頻度・使い分けを比較 https://rocket-boys.co.jp/security-measures-lab/security-assessment-comparison/ ④ 放置IDが侵入口に？管理者・テスト用アカウントの漏洩リスクと対策 - ACCESS ONLiNE https://access-online.net/abandoned-account-unauthorized-access-risk/ ⑤ Windowsの9月更新プログラムで「ファイル履歴」に不具合、バックアップに失敗 - マイナビニュース https://news.mynavi.jp/techplus/article/20260925-5020979/ #セキュリティ #CyberSecurity

The vulnerable function in CVE-2026-94384 is not a public endpoint that anyone on the Internet can call. The risk appears when an AWS principal that can already invoke a specific Lambda can use the broader permissions of that function's execution role ... https://x.com/i/article/2103135796278558720

AWS、Amazon ConnectとSalesforce連携に権限昇格の脆弱性 CVE-2026-94384　Lambda経由で本来拒否されたAWS API操作が可能に https://rocket-boys.co.jp/security-measures-lab/aws-amazon-connect-salesforce-cve-2026-94384/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

⚠️⚠️⚠️ 『Confirm the sfExecuteAWSService function has been deleted or disabled after setup.』 CVE-2026-94384 - Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService https://aws.amazon.com/jp/security/security-bulletins/2026-115-aws/

CVE-2026-94384 - Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService https://dlvr.it/TVcPwd #patchmanagement

A newly disclosed high-severity AWS Lambda flaw (CVE-2026-94384) lets attackers bypass IAM restrictions via sfExecuteAWSService in AmazonConnectSalesforceLambda. Fix version 5.26 released—upgrade now. Also review invoke permissions and disable unneeded functions. #AWS #Lambda #IAM #CloudSecurity #Vulnerability #DevOps https://thedailytechfeed.com/critical-aws-lambda-flaw-bypasses-iam-what-you-need-to-know/

CVE-2026-94384 (Connect→Salesforce Lambda): sfExecuteAWSService will run privileged AWS APIs for anyone with lambda:InvokeFunction — even if their own IAM is denied. Setup leftovers are agent-shaped risk. Upgrade to ≥5.26, then delete/disable that function or lock invoke to one principal. Don't leave "temporary" privilege bridges in the account.