AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Aug 20, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 133 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +11.1 pp

64.7% of AWS's 133 CVEs are CRITICAL or HIGH severity. Industry median: 53.6%. Source: NVD CVSS v3.1.

CRITICAL 10 (7.5%)HIGH 76 (57.1%)MEDIUM 47 (35.3%)

CISA KEV Listings

↑ +0.6 pp

2 of 133 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (1.5%). Industry median: 0.9%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -7.0 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 7 days.

Sample size: 89 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-78OS Command Injection8 CVEs
CWE-327Use of a Broken or Risky Cryptographic Algorithm6 CVEs
CWE-61UNIX Symbolic Link (Symlink) Following6 CVEs
CWE-787Out-of-bounds Write6 CVEs
CWE-125Out-of-bounds Read4 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

2026-083-AWSHigh
Aug 18, 2026
CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service
CVE-2026-75935 CVE-2026-75936 vendor source ↗
2026-082-AWSHigh
Aug 18, 2026
CVE-2026-75897 - Uncontrolled resource consumption in OpenSearch Dashboards capabilities route
CVE-2026-75897 vendor source ↗
2026-081-AWSHigh
Aug 13, 2026
CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass
CVE-2026-18428 vendor source ↗
2026-079-AWSHigh
Aug 13, 2026
CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin
CVE-2026-18952 vendor source ↗
2026-080-AWSHigh
Aug 12, 2026
CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++
CVE-2026-19642 CVE-2026-19643 vendor source ↗
2026-078-AWSHigh
Aug 12, 2026
CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
CVE-2026-19311 vendor source ↗
2026-077-AWSHigh
Aug 6, 2026
CVE-2026-19111 - Insecure direct object reference in Strands Agents Tools memory tools
CVE-2026-19111 vendor source ↗
2026-076-AWSHigh
Aug 5, 2026
CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
CVE-2026-18954 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Aug 20, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.