AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Jul 29, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 113 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

020220202302024262025872026

Severity Composition

↑ +10.2 pp

62.8% of AWS's 113 CVEs are CRITICAL or HIGH severity. Industry median: 52.6%. Source: NVD CVSS v3.1.

CRITICAL 9 (8.0%)HIGH 62 (54.9%)MEDIUM 42 (37.2%)

CISA KEV Listings

↑ +0.8 pp

2 of 113 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.8%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -10.8 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 11 days.

Sample size: 69 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

  • CWE-78OS Command Injection8 CVEs
  • CWE-327Use of a Broken or Risky Cryptographic Algorithm6 CVEs
  • CWE-61UNIX Symbolic Link (Symlink) Following6 CVEs
  • CWE-787Out-of-bounds Write5 CVEs
  • CWE-770Allocation of Resources Without Limits or Throttling4 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

  • 2026-065-AWSHigh
    Jul 23, 2026

    CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

    CVE-2026-16796vendor source ↗
  • 2026-064-AWSHigh
    Jul 23, 2026

    CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

    CVE-2026-16756vendor source ↗
  • 2026-063-AWSHigh
    Jul 23, 2026

    CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure

    CVE-2026-16584vendor source ↗
  • 2026-062-AWSHigh
    Jul 21, 2026

    CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

    CVE-2026-16317CVE-2026-16318vendor source ↗
  • 2026-061-AWSHigh
    Jul 21, 2026

    CVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

    CVE-2026-15957vendor source ↗
  • 2026-060-AWSHigh
    Jul 17, 2026

    CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

    CVE-2026-15415vendor source ↗
  • 2026-059-AWSHigh
    Jul 17, 2026

    CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector

    CVE-2026-12283vendor source ↗
  • 2026-057-AWS
    Jul 16, 2026

    CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

    CVE-2026-15895vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 29, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.