AWS — Security Activity Report

Amazon Web Services (Security Bulletins)

Generated Nov 2, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 207 CVEs with AWS advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +12.4 pp

66.2% of AWS's 207 CVEs are CRITICAL or HIGH severity. Industry median: 53.8%. Source: NVD CVSS v3.1.

CRITICAL 25 (12.1%)HIGH 112 (54.1%)MEDIUM 70 (33.8%)

CISA KEV Listings

↑ +1.8 pp

5 of 206 AWS CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (2.4%). Industry median: 0.6%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -11.3 days

Median time from CVE disclosure to AWS advisory: <1 day (p25 <1 day – p75 <1 day). Industry median: 11 days.

Sample size: 163 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across AWS's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-78OS Command Injection10 CVEs
CWE-918Server-Side Request Forgery (SSRF)9 CVEs
CWE-863Incorrect Authorization8 CVEs
CWE-283Unverified Ownership6 CVEs
CWE-327Use of a Broken or Risky Cryptographic Algorithm6 CVEs

Recent Security Advisories

Latest advisories published by AWS, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

2026-160-AWS
Oct 31, 2026
CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free Issue
CVE-2026-98432 vendor source ↗
2026-159-AWS
Oct 30, 2026
CVE-2026-119117 - Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
CVE-2026-119117 vendor source ↗
2026-158-AWS
Oct 30, 2026
CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
CVE-2026-119086 vendor source ↗
2026-157-AWS
Oct 30, 2026
CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C
CVE-2026-119148 CVE-2026-119116 vendor source ↗
2026-156-AWS
Oct 29, 2026
CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
CVE-2026-119115 vendor source ↗
2026-155-AWS
Oct 28, 2026
CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
CVE-2026-111497 vendor source ↗
2026-154-AWS
Oct 28, 2026
CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools
CVE-2026-115415 vendor source ↗
2026-153-AWSHigh
Oct 28, 2026
CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas
CVE-2026-118029 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Nov 2, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.