CVE-2026-35560

Medium

Elevated severity or exploit probability.

CVSS base

7.4 HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — probability of exploitation (30 days)

0.3%

18.2th percentile

CISA KEV

Not listed

Weakness / dates

CWE-295

Published 2026-04-03 · modified 2026-07-24

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector	N	Network
Attack Complexity	H	High
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	N	None

Timeline

2026-04-03 — Published (NVD)
2026-07-24 — Last modified (NVD)

Description

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.

Affected

amazon apple linux microsoft

References

Official: NVD · CVE.org