Use CloudTrail to find Systems Manager StartSession management events, then prioritize sessions involving AWS-StartPortForwardingSessionToRemoteHost. That can identify recorded activity to investigate, but a CloudTrail event alone cannot prove the vulnerability was exploited or instance-role credentials were exposed. Separately verify the SSM Agent version on each managed node: AWS identifies versions earlier than 3.3.4851.0 as affected within the stated scope.
What CVE-2026-89049 means for an investigation
AWS published security bulletin 2026-107-AWS on September 10, 2026. It describes a server-side request forgery flaw in SSM Agent’s Session Manager remote-host port-forwarding functionality. Improper validation of equivalent address representations could let an authenticated user who had port-forwarding permission bypass the remote-destination denylist and reach link-local endpoints. One potential consequence is exposure of the managed instance’s temporary IAM role credentials, which could then be used outside the instance with that role’s permissions.
As an Amazon Associate I earn from qualifying purchases.
AWS identifies SSM Agent versions earlier than 3.3.4851.0 as affected for versions supporting remote-host port forwarding. Version 3.3.4851.0 contains the fix; AWS recommends upgrading to the latest available version and patching forked or derivative code. The AWS-maintained GitHub advisory assigns the issue a CVSS v3 base score of 9.9. That is a severity rating, not a measure of how many customers or instances were affected or exploited.
Search CloudTrail for the relevant session requests
1. Cover the accounts and Regions that matter
Run the search in every AWS account and Region where managed nodes or Session Manager activity may exist. A single-Region trail covers only its configured Region; AWS recommends multi-Region trails to capture activity across Regions. For an incident review, also note which accounts, Regions, and dates your available evidence actually covers.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
2. Filter Event history for Systems Manager StartSession
- Open the AWS CloudTrail console and select Event history in the Region you are investigating.
- Filter for the Systems Manager event source and the
StartSessionevent name. - Set the date range of interest, then open relevant event records and retain the raw records for analysis.
Systems Manager control-plane operations are logged to CloudTrail as management events by default, and StartSession creates a CloudTrail entry. Event history is a regional view of recorded management events, not a complete record of every action taken through a session.
3. Prioritize remote-host port forwarding
Look for the document name AWS-StartPortForwardingSessionToRemoteHost, which AWS names in its interim mitigation guidance, and for other recorded evidence that a session used remote-host port forwarding. Treat a matching document as a reason to investigate the session, not as proof that a vulnerable destination was reached. Review the raw event because event shapes can vary and not every field is necessarily populated.
4. Record the context present in each event
For each relevant record, examine the principal and role session, event time, Region, source IP, target, document name, request parameters, and success or error details where present. These details help establish who made a recorded request, from where and when, and which target or document was involved when those values were recorded. The StartSession API accepts a document name and parameters, but do not assume every event contains every field.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Correlate CloudTrail with other evidence
A session request is a starting point, not an exploit verdict. AWS explains that CloudTrail records session API calls, while actions inside a session that do not make API calls are not detected by EventBridge. A StartSession record by itself does not establish that the vulnerable address was used, the denylist was bypassed, or credentials were obtained.
| Evidence source | What it can help establish | Important limit |
|---|---|---|
| CloudTrail event record | Recorded API request context, including identity, time, source, Region, and target or document where present. | Does not by itself show what happened inside a session or prove successful exploitation. |
| Systems Manager session history | Session ID, user, managed-node ID, start and end times, status, and configured session-log location. | Available detail depends on the history and logging retained; the console exposes more session details than the CLI history list. |
| Configured session data logs | Session activity captured by the logging configuration in effect. | They are a separate evidence source; availability depends on whether logging was configured and retained. |
| IAM activity and host or network telemetry | May help assess whether the instance role was used or whether related activity occurred. | Interpret alongside the specific role, account, resources, and time window; no single source necessarily establishes the complete attack path. |
| Fleet inventory and package records | Installed SSM Agent version on each managed node. | CloudTrail is not an inventory of agent binaries. |
Compare suspicious sessions with Systems Manager session history, any configured session data logs, IAM activity that could indicate use of the instance role, and relevant host or network telemetry. Preserve timestamps and identifiers so records from different systems can be correlated.
Check the SSM Agent version independently
Establish the installed agent version for every relevant managed node using fleet inventory or host and package-management records, then compare it with AWS’s affected-version scope and the platform’s package advisory. A CloudTrail search cannot tell you which SSM Agent binary was installed on a node at the time of an event.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
AWS lists 3.3.4851.0 as containing the fix and recommends moving to the latest available release. Amazon Linux advisories list package fixes separately: Amazon Linux 2 lists amazon-ssm-agent-3.3.5226.0-1.amzn2, and Amazon Linux 2023 lists amazon-ssm-agent-3.3.5226.0-1.amzn2023. Package availability can change, so check the current repository and the advisory for the operating system in use rather than treating those package versions as a universal installation instruction.
Understand the time and logging boundaries
CloudTrail Event history shows the last 90 days of recorded management events in a Region and does not include data events. For dates outside that window, use retained trail files in S3 or a CloudTrail Lake event data store if one was configured and still contains the relevant records. Session Manager history and session data logs have their own configuration and retention considerations.
The absence of a matching event in a limited search is not enough to conclude that an account was unaffected. First establish whether the search includes the right accounts, Regions, dates, and retained event sources, then assess the relevant nodes’ agent versions and other available session evidence.
Prioritize containment and preservation
- Upgrade affected installations. Use fleet inventory and the applicable distribution advisory to identify nodes that need an update, and verify the installed version after patching.
- Restrict remote-host port forwarding until upgrades are complete. Scope
ssm:StartSessionand Systems Manager document permissions so untrusted principals cannot start sessions usingAWS-StartPortForwardingSessionToRemoteHost. - Investigate possible credential exposure when activity is suspicious. Assess whether the instance profile’s temporary credentials may have been exposed, and review associated IAM activity and affected resources. AWS describes this as a potential impact; account-specific evidence is needed to determine whether it occurred.
- Preserve evidence promptly. Retain relevant CloudTrail files, Systems Manager session history, configured session logs, and host evidence before their retention windows expire.
What you can conclude
CloudTrail can help identify recorded Systems Manager session requests and their available context. Combine that evidence with session records, telemetry, and node-level version information to assess exposure. Distinguish three findings in your incident record: whether a node was running an affected agent version, whether a relevant remote-host port-forwarding session was recorded, and whether evidence supports successful access or credential use. A finding on one question does not automatically answer the others.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
