AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Oct 4, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 166 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +14.8 pp

68.1% of AWS's 166 CVEs are CRITICAL or HIGH severity. Industry median: 53.2%. Source: NVD CVSS v3.1.

CRITICAL 16 (9.6%)HIGH 97 (58.4%)MEDIUM 53 (31.9%)

CISA KEV Listings

↑ +0.4 pp

2 of 165 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.2%). Industry median: 0.8%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -24.3 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 24 days.

Sample size: 122 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-78OS Command Injection9 CVEs
CWE-327Use of a Broken or Risky Cryptographic Algorithm6 CVEs
CWE-61UNIX Symbolic Link (Symlink) Following6 CVEs
CWE-88Argument Injection or Modification6 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

2026-125-AWSHigh
Oct 2, 2026
CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution
CVE-2026-104019 vendor source ↗
2026-124-AWSHigh
Oct 2, 2026
CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS
CVE-2026-103956 CVE-2026-103957 CVE-2026-103958 vendor source ↗
2026-120-AWSHigh
Oct 2, 2026
CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver
CVE-2026-103505 vendor source ↗
2026-123-AWSHigh
Oct 1, 2026
CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
CVE-2026-104002 vendor source ↗
2026-122-AWSHigh
Oct 1, 2026
CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python
CVE-2026-104020 vendor source ↗
2026-121-AWSHigh
Oct 1, 2026
CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan
CVE-2026-97662 vendor source ↗
2026-119-AWSHigh
Sep 29, 2026
CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization
CVE-2026-100308 vendor source ↗
2026-118-AWSHigh
Sep 24, 2026
CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution
CVE-2026-96883 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Oct 4, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.