In plain language
What this advisory means
Amazon identified a security flaw in a hotpatch tool for Java applications that could let a local attacker run harmful commands as the system's highest-privilege user. This tool was designed to patch a previous serious vulnerability without restarting Java programs but contained a new issue involving command injection triggered by unusual characters in process paths.
Technical explanation
How the issue affects the environment
The vulnerability (CVE-2026-85656) lies in the log4j-cve-2021-44228-hotpatch package on Amazon Linux prior to version 1.3-9.amzn2. The hotpatch tool injects a Java agent to modify the lookup() method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances, preventing exploitation of the original Log4j remote code execution flaw (CVE-2021-44228). However, an OS command injection flaw was discovered that allows a local user to execute arbitrary commands as root. This occurs when a Java process has an executable path containing embedded newline characters, which the hotpatch improperly handles, leading to execution of unintended OS commands with elevated privileges.
Operational impact
Why teams should care
A local attacker with access to the vulnerable system could exploit this flaw to run any commands with root privileges, potentially compromising the entire system’s integrity, confidentiality, and availability. This elevates risk for organizations relying on AWS and Amazon Linux environments using this hotpatch without the fix applied.
Immediate action
Upgrade the log4j-cve-2021-44228-hotpatch package to version 1.3-9.amzn2 or later to address this command injection vulnerability. Use the package manager command 'yum update log4j-cve-2021-44228-hotpatch' or 'yum update --advisory ALAS2-2026-3784' to apply the update.
Affected and fixed releases
Temporary risk reduction
The official bulletin does not specify a workaround other than upgrading the package to the fixed version.
Evidence and validation checklist
- AWS Security Bulletin 2026-098-AWS published 09/04/2026
- Description of the OS command injection vulnerability in the hotpatch tool
- Mention of affected versions: Amazon Linux log4j-cve-2021-44228-hotpatch before 1.3-9.amzn2
- Resolution by upgrading to version 1.3-9.amzn2
- Commands recommended for upgrading the package
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.