AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Nov 13, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 231 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +11.8 pp

66.7% of AWS's 231 CVEs are CRITICAL or HIGH severity. Industry median: 54.9%. Source: NVD CVSS v3.1.

CRITICAL 27 (11.7%)HIGH 127 (55.0%)MEDIUM 77 (33.3%)

CISA KEV Listings

↑ +1.6 pp

5 of 230 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (2.2%). Industry median: 0.6%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -10.9 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 11 days.

Sample size: 187 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-78OS Command Injection11 CVEs
CWE-918Server-Side Request Forgery (SSRF)10 CVEs
CWE-863Incorrect Authorization9 CVEs
CWE-23Relative Path Traversal8 CVEs
CWE-283Unverified Ownership7 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

2026-182-AWS
Nov 12, 2026
CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
CVE-2026-126793 vendor source ↗
2026-181-AWS
Nov 12, 2026
CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
CVE-2026-127119 vendor source ↗
2026-180-AWS
Nov 11, 2026
CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry
CVE-2026-125926 vendor source ↗
2026-179-AWS
Nov 11, 2026
CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
CVE-2026-100307 vendor source ↗
2026-178-AWS
Nov 10, 2026
CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI
CVE-2026-124848 vendor source ↗
2026-177-AWS
Nov 10, 2026
CVE-2026-126087 - Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker agent
CVE-2026-126087 vendor source ↗
2026-176-AWS
Nov 10, 2026
CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
CVE-2026-125271 vendor source ↗
2026-175-AWS
Nov 9, 2026
CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK
CVE-2026-124035 CVE-2026-124034 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Nov 13, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.