{
  "id": 6882278,
  "title": "How to Use CloudTrail to Check Whether You Were Affected by the AWS SSM Agent Vulnerability (CVE-2026-89049)",
  "url": "https://urgent.news/2026/09/12/how-to-use-cloudtrail-to-check-whether-you-were-affected-by-the-aws",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T07:09:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/aws-builders/how-to-use-cloudtrail-to-check-whether-you-were-affected-by-the-aws-ssm-agent-vulnerability-1mln"
  },
  "original_language": "en",
  "account": "This report examines the AWS CloudTrail logs when an attempt is made to exploit CVE-2026-89049, a critical vulnerability in the AWS Systems Manager Agent. The vulnerability, disclosed on September 10, 2026, allows authenticated users with permission to create remote-host port-forwarding sessions to bypass the destination denylist and potentially access the EC2 Instance Metadata Service. The report outlines how CloudTrail records relevant events, including the StartSession API call and its parameters, while not capturing the actual traffic sent through the port-forwarding tunnel. It also discusses the difference in risk based on whether users have shell access to the managed instance and provides guidance on searching CloudTrail logs for potential exploitation attempts.",
  "summary": "In this post, I examine what is recorded in AWS CloudTrail when someone attempts to exploit CVE-2026-89049, a CVSS 9.9 vulnerability in the AWS Systems Manager Agent. The goal is to help readers determine whether their environments may have been targeted. Although the vulnerability has a Critical CVSS rating, its incremental impact depends heavily on how Session Manager permissions are…",
  "key_points": [
    "CloudTrail logs can reveal attempts to exploit CVE-2026-89049.",
    "Logs record StartSession API calls with relevant parameters.",
    "Shell access to managed instances increases exploitation risk."
  ],
  "editors_take": "This development helps users identify potential exploitation attempts of the AWS SSM Agent vulnerability by analyzing CloudTrail logs for specific API calls and parameters.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}