// AWSHIGH
CVE-2026-94384 is an IAM bypass vulnerability in AWS Lambda's AmazonConnectSalesforceLambda integration (versions 5.15–5.24.16). The sfExecuteAWSService function fails to validate caller permissions, allowing any IAM principal with lambda:InvokeFunction access to invoke the privileged function and execute AWS API operations their own identity is denied. AWS patched the flaw in June 2026 and published an advisory in September 2026; CVSS base score is 8.1 (High).
// Get alerts for AWS