Is CVE-2026-85656 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85656?

CVE-2026-85656 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-85656

Description

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.