External risk intelligence

Trusted Remote Execution command injection vulnerability in example SSM document script.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-122193

The vulnerability affects an internal script used for provisioning SSM documents within a Trusted Remote Execution environment. While the system operates over a network, the reachability is restricted to authenticated users with specific permissions to invoke these documents, making direct public internet exposure uncommon and typically reliant on internal access controls.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a script used for the Trusted Remote Execution service, potentially allowing an authenticated user with specific permissions to execute commands as the root user on managed instances. This could bypass established security policies.

A script flaw lets authorized users run commands.
It bypasses security policies on managed instances.
Confirm relevance and check for unauthorized script use.

Attack Path

How an attacker could exploit the issue

An authenticated user with permission to run specific scripts within the Trusted Remote Execution (REX) system could potentially execute arbitrary commands. This occurs when a privileged user invokes an example SSM document provisioning script, which fails to properly sanitize inputs, leading to unintended command execution on the managed instance with root privileges and bypassing security policies.

Authenticated user with document invocation permission.
Invoking a vulnerable example SSM document script.
Arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

An authenticated remote user with specific permissions could execute arbitrary commands as root on a managed instance when using the example SSM document provisioning script in Trusted Remote Execution. This could bypass security policies, affecting the integrity and availability of the managed instance.

System commands on managed instance.
Invoking specific SSM documents.
Arbitrary command execution as root.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in an example SSM document provisioning script requires immediate attention from teams managing AWS infrastructure and security. The first step is to inventory all accounts and regions for affected SSM documents, confirm their reachability, and identify the accountable owner before planning remediation.

Owner: Cloud Platform or Security Engineering.
Verify: Existence of affected SSM documents.
Action: Delete vulnerable SSM documents.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Trusted Remote Execution (REX) and what are SSM documents?

Trusted Remote Execution (REX) is a service designed to help organizations manage and execute operations across their cloud infrastructure. SSM documents act as blueprints or configuration files that define the specific tasks or commands the REX system should perform on your managed instances. In this context, the vulnerability involves a specific example provisioning script used to create these documents.

How does this CVE-2026-122193 vulnerability work?

This vulnerability is classified as an OS command injection (CWE-78). It happens because the affected provisioning script does not properly clean or validate the inputs it receives. If a user has permission to trigger this script, they can inject their own malicious commands, which the system then executes with root-level privileges on the managed instance, effectively overriding intended security policies.

Do I need to be a public-facing system to be at risk?

No. While the system operates over a network, this vulnerability is not triggered by arbitrary public requests. It requires an attacker to already have valid credentials and the specific permissions necessary to invoke the Rex-RO or Rex-RW SSM documents. Simply having an internet-facing instance does not automatically make you vulnerable if you have not implemented these specific scripts.

Is my environment at high risk?

According to Halo Surface Signal, this threat is currently labeled as unlikely. Because the vulnerability requires an authenticated user with pre-existing, elevated permissions to trigger the specific flawed script, it is not a typical public-facing risk. Most danger originates from internal access, so you should verify if these specific SSM documents are actually in use within your environment.

What should I do if I find these scripts?

If you identify SSM documents created from the affected example script, the recommended response is to delete them immediately. You should audit all accounts and regions where you manage infrastructure to locate any instances of these Rex-RO or Rex-RW documents. Once identified and removed, you eliminate the underlying risk associated with that specific provisioning path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.