In plain language
What this advisory means
Amazon's AmazonConnectSalesforceLambda application has a security issue in one of its setup functions called sfExecuteAWSService. This function lets authorized users pass commands to powerful AWS services without properly checking if they're allowed to do so. Because of this, someone with permission to run this function could perform actions they usually wouldn't have permission for, risking security. To fix this, users must upgrade the application, remove or disable the risky function after setup, or tightly control who can run it.
Technical explanation
How the issue affects the environment
The sfExecuteAWSService Lambda function in AmazonConnectSalesforceLambda does not enforce authorization checks on caller-supplied parameters. Although this function is intended for use only during initial setup, it forwards inputs to privileged AWS service APIs without verifying the caller’s permissions. Consequently, an IAM principal granted lambda:InvokeFunction permission on this function can bypass their standard IAM restrictions and invoke privileged AWS operations unlawfully. The issue affects versions 5.15 and later. AWS recommends upgrading to version 5.26 or newer, deleting or disabling the function after setup, or restricting invoke permissions strictly to the CTI Adapter’s IAM user and configuring related parameters accordingly.
Operational impact
Why teams should care
This vulnerability allows an attacker or insider with permission to invoke the sfExecuteAWSService Lambda function to perform AWS operations that their IAM role or user normally would not permit. Such unauthorized actions could lead to data breaches, resource misuse, service disruptions, or escalation of privileges in the AWS environment. The risk exists during the initial setup phase or afterward if the vulnerable function remains active and accessible without proper controls, potentially compromising enterprise security and compliance.
Immediate action
To address this vulnerability, upgrade AmazonConnectSalesforceLambda to version 5.26 or later. After completing setup, either delete or disable the sfExecuteAWSService function entirely. If retaining the function is necessary, restrict lambda:InvokeFunction permission on it strictly to the IAM user used by the CTI Adapter within your account, and set the SalesforceExecuteAWSServiceUser parameter to that same user. Additionally, employ service control policies or permission boundaries to deny invoke permissions to all other principals within the account to strengthen enforcement.
Affected and fixed releases
Temporary risk reduction
Limiting invoke permissions to a single trusted IAM user (the CTI Adapter user) and disabling or deleting the sfExecuteAWSService function after setup act as effective workarounds. No other workaround is specified by AWS.
Evidence and validation checklist
- CVE identifier CVE-2026-94384 issued for missing authorization in sfExecuteAWSService
- AWS official Security Bulletin 2026-115-AWS published on 09/22/2026
- Description of missing authorization allowing IAM principals with invoke permissions to perform unauthorized AWS operations
- Recommendation to upgrade to version 5.26 or later
- Guidance to delete, disable, or restrict invoke permissions on the vulnerable Lambda function
- Verification steps to confirm remediation
- Acknowledgement of vulnerability reporter contribution
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.