Contrast before 1.18.0 AML Injection Remote Code Execution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100839 · Microsoft / collected KEV context

EUVD-2026-87849

GHSA-qm93-38mp-vr3v

GHSA-g9ww-x58f-9g6m

GO-2026-4863

cve-program · CVE-2026-100839

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
• https://www.vulncheck.com/advisories/contrast-before-1.18.0-aml-injection-remote-code-execution

euvd · EUVD-2026-87849

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
• https://www.vulncheck.com/advisories/contrast-before-1.18.0-aml-injection-remote-code-execution

nvd · CVE-2026-100839

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
• https://www.vulncheck.com/advisories/contrast-before-1.18.0-aml-injection-remote-code-execution

osv · GHSA-g9ww-x58f-9g6m

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
• https://blackhat.com/eu-24/briefings/schedule/#aml-injection-attacks-on-confidential-vms-42723
• https://dl.acm.org/doi/pdf/10.1145/3719027.3765123
• https://github.com/edgelesssys/contrast

osv · GO-2026-4863

• https://github.com/edgelesssys/contrast/security/advisories/GHSA-g9ww-x58f-9g6m
• https://blackhat.com/eu-24/briefings/schedule/#aml-injection-attacks-on-confidential-vms-42723
• https://dl.acm.org/doi/pdf/10.1145/3719027.3765123

No related operational record is retained in the current change model.