Column 1
Skip to content

AWS SSM Agent CVE-2026-89049: Update and Review Session Access

September 10, 2026

Priority: update affected AWS Systems Manager Agent installations and review who can start remote-host port-forwarding sessions. AWS identifies CVE-2026-89049 as a critical issue in SSM Agent versions before 3.3.4851.0. Version 3.3.4851.0 contains the fix. Use that version or a later release that retains the correction through your approved update process.

Scope: Fix I.T. Phill has not assessed your AWS account or managed nodes. This is a defensive maintenance guide, not evidence that your environment is affected or compromised. The feature image is a general server-maintenance illustration, not an AWS console screenshot or proof of a completed update.

Who Needs to Review This Update?

The advisory concerns SSM Agent and its Session Manager functionality. It is not a WordPress core, PHP runtime or Linux kernel vulnerability. AWS describes a prerequisite: an authenticated user must have permission to start the relevant remote-host port-forwarding sessions. The potential impact includes exposure of temporary credentials associated with a managed instance’s IAM role, with the permissions of that role limiting their reach. Do not describe this as anonymous access to every AWS account.

The official AWS repository advisory was published on September 10, 2026. This guide does not claim a newly observed attack, active exploitation in your environment or a CISA KEV addition.

Plan a Controlled Agent Update

  1. Establish the inventory. Ask the account owner to identify managed nodes, their installed SSM Agent versions and the teams responsible for maintaining them. Include reusable machine images and deployment definitions so replacement nodes do not reintroduce an older agent.
  2. Check the exact release. Match the agent package to your operating system and approved distribution method. Confirm that the chosen release includes the 3.3.4851.0 correction; a scheduled update job is not evidence that every node has received it.
  3. Review access while updating. AWS recommends limiting the relevant session capability to trusted principals until the fix is deployed. Have an authorized AWS administrator review session access and role permissions. Keep an approved management path available while making planned changes.
  4. Validate normal operation. After the approved change, confirm the installed agent version and managed-node connectivity. Test ordinary authorized administration and the workloads that depend on it, then record the node, release, completion time and any remaining exceptions in your private maintenance records.

Separate Patching From Credential and Incident Review

Installing a patched agent alone does not establish that earlier activity was harmless or that previously exposed credentials were never used. If your security team identifies suspicious session or account activity, follow your incident-response process with AWS support and the account owner. Keep evidence and credential-handling decisions private. Do not publish session records, account identifiers or credentials in support comments.

A failed update or disconnected node remains an exception to resolve, not a completed rollout. Agree on operational recovery with the system owner rather than treating a return to an affected version as a security fix.

Hosting and WordPress Operations

For WordPress hosted on AWS, agent maintenance and site maintenance are separate checks. Confirm the site’s normal pages, administrative access and business workflows after the infrastructure owner completes the authorized work. Our WordPress support service can help coordinate application checks, while the security guide collection provides related maintenance context. Neither replaces your AWS account owner’s access review.

Primary references: AWS SSM Agent security advisory and SSM Agent 3.3.4851.0 release. Recheck official guidance when planning a later maintenance window.