How to Use CloudTrail to Check Whether You Were Affected by the AWS SSM Agent Vulnerability (CVE-2026-89049)
In this post, I examine what is recorded in AWS CloudTrail when someone attempts to exploit CVE-2026-89049, a CVSS 9.9 vulnerability in the AWS Systems Manager Agent. The goal is to help readers determine whether their environments may have been targeted. Although the vulnerability has a Critical CVSS rating, its incremental impact depends heavily on how Session Manager permissions are…
This report examines the AWS CloudTrail logs when an attempt is made to exploit CVE-2026-89049, a critical vulnerability in the AWS Systems Manager Agent. The vulnerability, disclosed on September 10, 2026, allows authenticated users with permission to create remote-host port-forwarding sessions to bypass the destination denylist and potentially access the EC2 Instance Metadata Service.
The report outlines how CloudTrail records relevant events, including the StartSession API call and its parameters, while not capturing the actual traffic sent through the port-forwarding tunnel. It also discusses the difference in risk based on whether users have shell access to the managed instance and provides guidance on searching CloudTrail logs for potential exploitation attempts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
