AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Sep 19, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 171 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

0202202023020242720251432026

Severity Composition

↑ +14.8 pp

67.8% of AWS's 171 CVEs are CRITICAL or HIGH severity. Industry median: 53.1%. Source: NVD CVSS v3.1.

CRITICAL 15 (8.8%)HIGH 101 (59.1%)MEDIUM 55 (32.2%)

CISA KEV Listings

↑ +0.4 pp

2 of 170 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.2%). Industry median: 0.8%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -8.7 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 9 days.

Sample size: 124 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

  • CWE-78OS Command Injection12 CVEs
  • CWE-787Out-of-bounds Write7 CVEs
  • CWE-327Use of a Broken or Risky Cryptographic Algorithm6 CVEs
  • CWE-61UNIX Symbolic Link (Symlink) Following6 CVEs
  • CWE-125Out-of-bounds Read5 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

  • 2026-115-AWSHigh
    Sep 17, 2026

    CVE-2026-92943 - Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

    CVE-2026-92943vendor source ↗
  • 2026-113-AWSHigh
    Sep 16, 2026

    CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

    CVE-2026-86831vendor source ↗
  • 2026-112-AWSHigh
    Sep 14, 2026

    CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

    CVE-2026-86830vendor source ↗
  • 2026-111-AWSHigh
    Sep 11, 2026

    CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

    CVE-2026-89332vendor source ↗
  • 2026-110-AWSHigh
    Sep 11, 2026

    CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

    CVE-2026-89090vendor source ↗
  • 2026-109-AWSHigh
    Sep 11, 2026

    CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

    CVE-2026-18061vendor source ↗
  • 2026-108-AWSHigh
    Sep 11, 2026

    CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection

    CVE-2026-89065CVE-2026-89066vendor source ↗
  • 2026-107-AWSHigh
    Sep 10, 2026

    CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

    CVE-2026-89049vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Sep 19, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.