AWS bulletin 2026-136-AWS (Oct 15) covers a deserialization bug in the Gremlin graph-data import path of the Amazon Neptune engine, tied to Apache TinkerPop. Per the CVE record, an authenticated user with ordinary Neptune data-plane (query) permissions could execute arbitrary code and access internal service credentials (CVSS 3.1 9.9, scope changed). It affects engine versions 1.2.0.0 and later. Fixes are in engine versions 1.5.0.0, 1.4.8.1 and 1.4.7.1. Clusters with auto minor version upgrade get the fix in their next maintenance window; clusters that pin engine versions must be upgraded manually. Until then, AWS says to grant neptune-db query permissions only to trusted principals. AWS doesn't mention exploitation.