CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials
Amazon ECS ยท 2026-10-19
Actions
Technical Details
| Affected Versions | 1.47.0 through 1.102.2 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-7461 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update ECS Windows worker instances to ECS agent version 1.103.0 to address the command injection vulnerability (CVE-2026-7461) and enhance security posture.
For Platform Teams
Deploy the updated ECS agent version 1.103.0 across all ECS Windows worker instances to resolve the identified security vulnerability and maintain platform integrity.
For Executives
Implement the latest ECS-optimized Windows AMI to mitigate the OS command injection vulnerability (CVE-2026-7461) and ensure system security.
Source
Related Amazon ECS Updates
- CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials (2026-10-14)
- Amazon ECS adds Amazon VPC Lattice support for blue/green, linear, and canary deployments (2026-10-02)
- CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials (2026-09-29)
- CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials (2026-09-25)
- Amazon ECS expands IAM condition key support for RunTask and StartTask APIs (2026-09-10)