// AWSCRITICAL
CVE-2026-89049 in AWS Systems Manager Agent allows authenticated attackers to bypass port-forwarding restrictions on link-local addresses and access the EC2 Instance Metadata Service, potentially retrieving temporary IAM credentials. Affects versions prior to 3.3.4851.0. AWS recommends immediate patching and restricting access to the AWS-StartPortForwardingSessionToRemoteHost document until systems are updated.
// Get alerts for AWS