Run this in each region you use, and flag anything not on 1.5.0.0, 1.4.8.1 or 1.4.7.1 (or later). Also flag any instance with auto minor version upgrade set to False, since those won't patch themselves:

aws neptune describe-db-instances --region us-east-1 \
  --query 'DBInstances[?Engine==`neptune`].[DBInstanceIdentifier,DBClusterIdentifier,EngineVersion,AutoMinorVersionUpgrade]' \
  --output table

Then list which IAM principals have neptune-db:* or neptune-db:connect access. The bug needs only query permissions, so app roles and shared analyst roles count, not just admins.