AWS is asking users of Trusted Remote Execution (REX) to remove SSM documents created from an unsafe setup example. The affected deployments need a configuration cleanup rather than a REX package upgrade.
The November 6 security bulletin, published at 09:00 PST, identifies CVE-2026-122193 in the example that provisioned Rex-RO and Rex-RW documents. A caller permitted to invoke one of those documents could submit crafted parameters that execute operating-system commands outside the sandbox. AWS says the same issue affects scriptArgs.
The permissions boundary is the important part
The CVE Program record submitted by Amazon describes possible arbitrary command execution as root on a managed instance, bypassing Cedar policy enforcement. It requires an authenticated remote user with permission to invoke the affected document; this is not an unauthenticated attack against every AWS account.
Amazon assigns a Critical rating: CVSS 3.1 is 9.9, while CVSS 4.0 is 9.3. Those scores describe the submitted vulnerability assessment, rather than evidence that an intrusion has occurred.
The REX repository describes Rhai scripts operating through APIs governed by Cedar authorization for file access, networking and process management. That explains the significance of an invocation path that reaches the host outside those checks: a restricted script policy cannot be assumed to contain commands executed through a separate vulnerable path.
Find the deployed examples, then remove them
AWS says no shipped REX artifact version is affected. It removed the documentation example and recommends deleting documents created from it in every account and Region where it was run. The bulletin lists no workaround.
The Systems Manager guide explains deletion through the Documents console. Its CLI reference recommends disassociating managed nodes before deleting a document; deletion also removes the document’s managed-node associations.
DaySec recommends checking deployment templates and internal runbooks as well as live accounts, so an old copied example does not recreate the exposure. Reviewing who could invoke the documents and retaining relevant execution records can also help assess whether further investigation is needed.
CISA’s enrichment in the CVE record listed no exploitation on November 6. That is a dated assessment, not a guarantee that no unreported use has occurred.
