CVE-2026-22611

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. This issue has been patched in version 4.0.3.3.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-226127.8Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "bui CVE-2026-226135.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac CVE-2026-226146.1The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access CVE-2026-226157.2Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privil CVE-2026-226167.5Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffi CVE-2026-226177.4Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the c CVE-2026-226187.1A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecur CVE-2026-226199.9Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut CVE-2026-22627.5The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via CVE-2026-226208.6Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a CVE-2026-226218.3Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated CVE-2026-226228.8Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated