CVE-2026-85656: Amazon Linux log4j Hotpatch RCE Vulnerability

CVE-2026-85656 Overview

CVE-2026-85656 is an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package shipped with Amazon Linux. Versions prior to 1.3-9 fail to sanitize embedded newline characters in the executable path of scanned Java processes. A local user can craft a Java process whose executable path contains newline characters to inject arbitrary shell commands. The hotpatch service runs with elevated privileges, so injected commands execute as root. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
A local, low-privileged user can achieve arbitrary command execution as root on affected Amazon Linux systems running the vulnerable hotpatch package.

Affected Products

Amazon Linux log4j-cve-2021-44228-hotpatch package versions before 1.3-9
Amazon Linux 2 systems with the hotpatch service enabled
Amazon Linux hosts that installed the Log4Shell hotpatch to mitigate CVE-2021-44228

Discovery Timeline

2026-09-04 - CVE-2026-85656 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85656

Vulnerability Analysis

The log4j-cve-2021-44228-hotpatch package was released by AWS to mitigate the original Log4Shell vulnerability by scanning running Java Virtual Machines and injecting a runtime patch. To locate candidate JVMs, the hotpatch daemon enumerates processes and reads their executable paths from /proc. The daemon then passes those paths to shell operations without neutralizing embedded newline characters.

An unprivileged local user who can start a Java process can control the executable path by launching the binary from a directory whose name contains a newline followed by shell metacharacters. When the hotpatch service processes that path, the injected shell fragment executes with root privileges.

The attack requires local access with low privileges and no user interaction. The scope is limited to the local host but yields full confidentiality, integrity, and availability impact on the affected system.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command [CWE-78]. The hotpatch component constructs shell command strings that include untrusted process path data. Because newline characters are not filtered or escaped, an attacker-controlled path terminates the intended command and appends arbitrary commands that the shell interprets and executes.

Attack Vector

Exploitation is entirely local. An attacker with shell access on an Amazon Linux host places a Java executable inside a directory path that contains embedded newlines and shell payload fragments. The attacker then executes the Java binary. When the hotpatch service enumerates JVMs and processes the crafted path, the injected commands run as root.

No verified public exploit code is available. Refer to the AWS Security Advisory ALAS2-2026-3784 and AWS Security Bulletin 2026-098 for vendor technical details.

Detection Methods for CVE-2026-85656

Indicators of Compromise

Process executable paths under /proc/<pid>/exe that resolve to directories containing newline (\n) characters or shell metacharacters.
Unexpected child processes spawned by the log4j-cve-2021-44228-hotpatch service or its log4j-cve-2021-44228-hotpatch.service systemd unit.
Root-owned processes or files created shortly after a non-privileged user launched a Java binary from an unusual path.

Detection Strategies

Audit filesystem events for directory creation containing non-printable or newline characters, especially in user-writable locations such as /tmp and /home.
Monitor execve syscalls where the executable path contains control characters, using auditd or eBPF-based instrumentation.
Correlate hotpatch service activity with subsequent privileged command execution to identify anomalous parent-child process relationships.

Monitoring Recommendations

Enable auditd rules on execve and execveat to log full process arguments and paths.
Track the installed version of log4j-cve-2021-44228-hotpatch across the fleet and alert on hosts running versions earlier than 1.3-9.
Alert on any shell process (bash, sh) whose parent process is the hotpatch daemon.

How to Mitigate CVE-2026-85656

Immediate Actions Required

Upgrade the log4j-cve-2021-44228-hotpatch package to version 1.3-9 or later on all Amazon Linux and Amazon Linux 2 hosts.
Inventory systems where the hotpatch was installed and confirm the current package version using rpm -q log4j-cve-2021-44228-hotpatch.
Restrict shell access on affected hosts to trusted users until the patch is applied.

Patch Information

AWS released the fixed package log4j-cve-2021-44228-hotpatch-1.3-9 through the standard Amazon Linux repositories. Details are documented in AWS Security Advisory ALAS2-2026-3784 and AWS Security Bulletin 2026-098. Apply the update using yum update log4j-cve-2021-44228-hotpatch on Amazon Linux 2, then verify the installed version.

Workarounds

Disable and stop the hotpatch service where the original Log4Shell mitigation is no longer required, using systemctl disable --now log4j-cve-2021-44228-hotpatch.service.
Remove the package entirely on systems that have upgraded Log4j to a patched version and no longer depend on runtime hotpatching.
Enforce strict filesystem permissions to prevent unprivileged users from creating directories with control characters in their names.

bash

# Configuration example
sudo yum update -y log4j-cve-2021-44228-hotpatch
rpm -q log4j-cve-2021-44228-hotpatch
sudo systemctl status log4j-cve-2021-44228-hotpatch.service