Is CVE-2026-83497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83497 being exploited in the wild.

How severe is CVE-2026-83497?

High severity, with a CVSS score of 8.8, published 31 August 2026.

Which products and versions are affected?

OpenSearch Project OpenSearch SQL Plugin 2.8 to 3.6.

Is there a fix for CVE-2026-83497?

A patch was published on 2026-08-31: Patches available: OpenSearch SQL Plugin v3.7 and v2.19.6; AWS OpenSearch Service patched via service software update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83497 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-83497?

Check whether you run Amazon AWS or OpenSearch Project OpenSearch SQL Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83497: OpenSearch SQL Plugin unrestricted Java deserialization in cursor pagination

CVE-2026-83497 · Severity: high · CVSS 8.8 · Published 2026-08-31

OpenSearch is an open-source search and analytics engine used by organizations to index, search, and analyze data in real time. A vulnerability in the SQL plugin allows authenticated users with basic read/search permissions to execute arbitrary code on the server by sending a specially crafted cursor parameter. This could allow an attacker to compromise the server, access sensitive data, or disrupt search and analytics operations.

Technologies: Amazon AWS. Vendors: Amazon, OpenSearch Project.

Quick answers

Is CVE-2026-83497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83497 being exploited in the wild.
How severe is CVE-2026-83497?: High severity, with a CVSS score of 8.8, published 31 August 2026.
Which products and versions are affected?: OpenSearch Project OpenSearch SQL Plugin 2.8 to 3.6.
Is there a fix for CVE-2026-83497?: A patch was published on 2026-08-31: Patches available: OpenSearch SQL Plugin v3.7 and v2.19.6; AWS OpenSearch Service patched via service software update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83497 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-83497?: Check whether you run Amazon AWS or OpenSearch Project OpenSearch SQL Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Java deserialization flaw in the OpenSearch SQL Plugin's cursor pagination handling. The /plugins/sql endpoint accepts a cursor parameter that is deserialized without proper validation, allowing an attacker to supply a malicious serialized object. The attack requires network access to the OpenSearch instance and valid authentication credentials (basic read/search permissions are sufficient), but no additional user interaction. A successful exploit allows remote code execution with the privileges of the OpenSearch process. Patches are available: version 3.7 and 2.19.6 for open-source deployments, and a service software update for AWS-managed OpenSearch Service instances (v2.9 to v3.5).

Affected products

OpenSearch Project OpenSearch SQL Plugin 2.8 to 3.6
Amazon OpenSearch Service 2.9 to 3.5

Timeline

2026-08-31: disclosed: AWS Security Bulletin published
2026-08-31: patched: Patches available: OpenSearch SQL Plugin v3.7 and v2.19.6; AWS OpenSearch Service patched via service software update

References

https://aws.amazon.com/security/security-bulletins/rss/2026-092-aws/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.