CVE intelligence

CVE-2026-13762

Vulnerability intelligence

Published Jun 29, 2026Sources checked Oct 28, 2026

9.8CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-13762 and is rated Critical severity with a CVSS score of 9.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

AWS Security Bulletins guidance

Vendor revision: Oct 19, 2026

This issue was remediated server-side; no customer action is required.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.6%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-13762?

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected.

This issue was remediated server-side. No customer action is required.

Source: NVD