CVE-2026-94384 - Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService
Amazon Connect ยท 2026-09-22
Actions
Technical Details
| Affected Versions | 5.15, 5.24.16 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-94384 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the AmazonConnectSalesforceLambda to version 5.26 or later, and configure IAM permissions to restrict invocation of the sfExecuteAWSService function to the designated IAM user to address the missing authorization issue identified as CVE-2026-94384.
For Platform Teams
Deploy the updated AmazonConnectSalesforceLambda version and enforce strict IAM permission controls on the sfExecuteAWSService function to enhance security and compliance within the platform.
For Executives
Implement the upgrade to AmazonConnectSalesforceLambda version 5.26 or later to mitigate the security risk posed by CVE-2026-94384 and ensure compliance with authorization protocols.
Source
Related Amazon Connect Updates
- Amazon Connect Customer now lets you create, manage, and search custom metrics through APIs (2026-09-16)
- Amazon Connect Customer custom metrics now supports tag-based access control (2026-09-16)
- Amazon Connect Customer can now import evaluation form PDFs using AI (2026-09-16)
- Amazon Connect Customer now enables agents to bid on preferred shifts (2026-09-15)
- Amazon Connect Customer now lets you set specific capacity limits for different types of Tasks and Emails (2026-09-09)