Technology · Amazon
Amazon AWS vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 198 vulnerabilities in Amazon AWS: 11 in the last 7 days and 105 in the last 90 days, 22 of them critical and 4 exploited in the wild. The most recent, CVE-2026-126793, was published on 12 November 2026. 40 vulnerabilities in the last four weeks, up 90% on the four before (21). 8 critical against 3, 2 exploited in the wild against 0.
- Last 7 days
- 11
- Last 90 days
- 105
- Critical, all time
- 22
- Exploited in the wild
- 4
About Amazon AWS
Amazon Web Services is a cloud computing platform offering computing, storage, and networking services.
Latest Amazon AWS vulnerabilities
- CVE-2026-126793: An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release…highCVSS 8
- CVE-2026-127119: AWS SDK for pandas EMR unverified bucket ownershiphighCVSS 5.3
- CVE-2026-125926: Amazon mcp-gateway-registry server-side request forgery in registration APIhighCVSS 8.5
- CVE-2026-100307: Amazon mcp-gateway-registry authorization bypass in management APIhighCVSS 8.8
- CVE-2026-124848: AWS Kiro CLI incorrect default permissions on session fileshighCVSS 5.5
- CVE-2026-126087: OpenJD Sessions for Python untrusted search path in process launcherhighCVSS 8.8
- CVE-2026-125271: AWS API MCP Server security policy bypass via operation name normalizationhighCVSS 7.8
- CVE-2026-124034: Amazon Braket SDK arbitrary file overwrite and code executionhighCVSS 6.4EPSS 0.5%
- CVE-2026-124033: AWS ParallelCluster CLI path traversal in log export commandshighCVSS 6.4EPSS 0.4%
- CVE-2026-119923: Babelfish for PostgreSQL heap-based buffer overflow in TDS prelogin parsercriticalCVSS 9.8
- CVE-2026-122193: AWS Trusted Remote Execution OS command injection in SSM documentcriticalCVSS 9.9
- CVE-2026-119083: GluonTS arbitrary file write during archive extractionhighCVSS 7.8
- CVE-2026-122266: Amazon aws-network-policy-agent improper isolation of shared resourceshighCVSS 8.7
- CVE-2026-122192: AWS Firecracker memory access in guest VM after snapshot restorehighCVSS 7.5
- CVE-2026-109518: APT package manager hard link reuse remote code executionhigh
- CVE-2026-119084: Amazon Redshift JDBC Driver unsafe class loading in connection parametershighCVSS 8.1
- CVE-2026-121652: AWS Amplify maplibre-gl-js-amplify stored XSS in popup renderinghighCVSS 5.4
- CVE-2026-119922: Babelfish for PostgreSQL privilege escalationhighCVSS 8.8
- CVE-2026-116635: AWS Serverless MCP Server path traversal in deployment statushighCVSS 6.1
- CVE-2026-120497: AWS AI-DLC Workflows aidlc-traceability stored XSS in HTML reporthighCVSS 5
- CVE-2026-119085: Amazon Virtual Engineering Workbench template injection in publishing componenthighCVSS 8.8
- CVE-2026-119301: AWS SDK for pandas SQL injection in Iceberg identifier generationhighCVSS 7.9
- CVE-2026-119117: Amazon Kinesis Producer Library for Java credential logginghighCVSS 6.5
- CVE-2026-119086: Amazon FreeRTOS-Kernel type validation bypass in xQueueSelectFromSethighCVSS 6.5
- CVE-2026-119116: AWS Nitro Enclaves SDK for C use-after-free and KMS impersonationhighCVSS 7.8
Most severe Amazon AWS vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-46300: Linux Kernel out-of-bounds write in skbuff coalescingcriticalexploited in the wildCVSS 7.8EPSS 10.2%
- CVE-2026-31431: Linux Kernel crypto algif_aead improper memory handlingcriticalexploited in the wildCVSS 7.8EPSS 2.6%
- CVE-2026-111497: Google Brotli buffer overflow in decodercriticalexploited in the wildCVSS 4EPSS 82.6%
- CVE-2026-109618: PHP Memory Corruption Vulnerabilitycriticalexploited in the wildEPSS 100.0%
- CVE-2026-103956: Loom for AWS authentication bypass and credential disclosurecriticalCVSS 10EPSS 0.5%
- CVE-2026-89049: AWS Systems Manager Agent SSRF in Session Manager port forwardingcriticalCVSS 9.9EPSS 0.7%
- CVE-2026-77810: AWS Athena Federated Query Neptune Connector credential exposurecriticalCVSS 9.9EPSS 0.6%
- CVE-2026-110812: Amazon Neptune unsafe deserialization in Gremlin graph-importcriticalCVSS 9.9EPSS 0.4%
- CVE-2026-122193: AWS Trusted Remote Execution OS command injection in SSM documentcriticalCVSS 9.9
- CVE-2026-112380: Kiro Crew missing authorization in WhatsApp group channelcriticalCVSS 9.9
Vulnerabilities per week
40 vulnerabilities in the last four weeks, up 90% on the four before (21). 8 critical against 3, 2 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 1 | |
| 24 Aug 2026 | 3 | 0 | |
| 31 Aug 2026 | 10 | 0 | |
| 7 Sep 2026 | 17 | 3 | |
| 14 Sep 2026 | 3 | 0 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 7 | 2 | |
| 5 Oct 2026 | 8 | 1 | |
| 12 Oct 2026 | 7 | 2 | |
| 19 Oct 2026 | 12 | 4 | |
| 26 Oct 2026 | 8 | 0 | |
| 2 Nov 2026 | 13 | 2 | |
| 9 Nov 2026 | 9 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Amazon AWS vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/aws)<a href="https://junglewise.ai/threats/technologies/aws"><img src="https://junglewise.ai/threats/technologies/aws/badge.svg" alt="Amazon AWS vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/aws.json, and this page as text at https://junglewise.ai/threats/technologies/aws.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Amazon AWS vulnerabilities", https://junglewise.ai/threats/technologies/aws, 12 November 2026.