Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1…

CVE-2026-7461 is a command injection vulnerability in Amazon ECS Agent for Windows versions before 1.103.0. The vulnerability exists in the FSx Windows File Server volume mounting component where improper input neutralization allows remote authenticated attackers to execute shell commands with SYSTEM privileges. The attack vector requires specially crafted username fields in ECS task definitions and permissions to register task definitions or write to Secrets Manager/SSM Parameter Store. This critical vulnerability provides privilege escalation to SYSTEM level on the underlying Windows host. Remediation requires upgrading to Amazon ECS Agent version 1.103.0 or later.