CVE-2026-81849

CVE-2026-81849 is a path traversal flaw (CWE-23) in the aws:downloadContent plugin of AWS Systems Manager Agent (amazon-ssm-agent) before 3.3.4515.0. It is triggered when an authenticated remote user whose ssm:SendCommand permission is limited to the AWS-DownloadContent document directs the agent to download from an S3 source using crafted object keys, allowing files to be written outside the intended download directory with root privileges. By overwriting specific sensitive files on the host, an attacker can escalate this to arbitrary code execution as root. Affected parties are any SSM-managed instances (EC2 or hybrid/on-premises) running an agent version older than 3.3.4515.0, particularly environments where downloadContent permissions were assumed to be safely scoped. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.6% chance of exploitation within 30 days.

What to do: Upgrade amazon-ssm-agent to version 3.3.4515.0 or later on all managed instances, using the Systems Manager agent auto-update association or your fleet update process where enabled. Audit IAM policies that grant ssm:SendCommand scoped to AWS-DownloadContent, since such restricted principals are the intended trigger for this flaw, and verify on affected hosts that no sensitive root-owned files (e.g., cron, systemd, or authorized_keys files) were modified unexpectedly. Restricting SendCommand to AWS-DownloadContent alone is not a sufficient mitigation on vulnerable agent versions.