CVE-2026-83497: Amazon Opensearch Service

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

Affected products

• Amazon Amazon Opensearch Service: from 2.9, up to and including 3.5
• Opensearch Opensearch: from 2.8, up to and including 3.6

Published 2026-08-31. Last modified 2026-09-03.