# Amazon Web Services vulnerabilities Source: https://junglewise.ai/threats/vendors/amazon-web-services Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 20:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/amazon-web-services.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 51 vulnerabilities in Amazon Web Services: 2 in the last 7 days and 9 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-127119, was published on 12 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 2 critical against 0. 7 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 4 - Last 90 days: 9 - All time: 51 (5 critical, 0 exploited in the wild) ## About Amazon Web Services Amazon Web Services (AWS) is a cloud computing platform providing infrastructure, platform, and software-as-a-service offerings. ## Latest Amazon Web Services vulnerabilities - [CVE-2026-127119: AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in) (high, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-122193: AWS Trusted Remote Execution OS command injection in SSM document](https://junglewise.ai/threats/cve-2026-122193-os-command-injection-in-the-example-ssm-document-provisioning) (critical, CVSS 9.9, published 6 Nov 2026) - [CVE-2026-115813: Amazon Web Services Multi Model Server server-side request forgery in model download](https://junglewise.ai/threats/cve-2026-115813-server-side-request-forgery-in-the-model-download-path-in-amazon) (medium, CVSS 5.8, published 23 Oct 2026) - [CVE-2026-115812: Amazon Web Services Multi Model Server path traversal and SSRF](https://junglewise.ai/threats/cve-2026-115812-and-issue-in-amazon-web-services-multi-model-server) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2026-107332: AWS Toolkit for Visual Studio Code insecure credentials file permissions](https://junglewise.ai/threats/cve-2026-107332-insecure-default-file-permissions-on-cached-credentials-in-aws) (high, published 8 Oct 2026) - [CVE-2026-87913: AWS Security Agent MCP server missing S3 bucket ownership verification](https://junglewise.ai/threats/cve-2026-87913-aws-security-agent-mcp-server-missing-s3-bucket-ownership) (medium, CVSS 5.9, published 10 Sep 2026) - [CVE-2026-18952: OpenSearch Security Analytics Plugin missing input validation](https://junglewise.ai/threats/cve-2026-18952-opensearch-security-analytics-plugin-missing-input-validation) (high, published 9 Sep 2026) - [CVE-2026-18953: AWS Transform MCP Server improper pathname validation](https://junglewise.ai/threats/cve-2026-18953-aws-transform-mcp-server-improper-pathname-validation) (high, published 9 Sep 2026) - [CVE-2026-75897: OpenSearch Dashboards uncontrolled resource consumption in capabilities route](https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2026-18481: AWS Ops Wheel stored XSS in participant URL handling](https://junglewise.ai/threats/cve-2026-18481-aws-ops-wheel-stored-xss-in-participant-url-handling) (high, CVSS 7.3, published 31 Jul 2026) - [CVE-2026-15737: AWS Bedrock AgentCore Python SDK sensitive information disclosure in OpenTelemetry spans](https://junglewise.ai/threats/cve-2026-15737-aws-bedrock-agentcore-python-sdk-sensitive-information-disclosure) (high, CVSS 5.7, published 16 Jul 2026) - [CVE-2026-15895: AWS jsii-diff OS command injection in npm package loading](https://junglewise.ai/threats/cve-2026-15895-aws-jsii-diff-os-command-injection-in-npm-package-loading) (high, CVSS 7.8, published 15 Jul 2026) - [CVE-2026-15746: Amazon Strands Agents Tools SSRF in elasticsearch_memory tool](https://junglewise.ai/threats/cve-2026-15746-amazon-strands-agents-tools-ssrf-in-elasticsearch-memory-tool) (high, CVSS 6.5, published 15 Jul 2026) - [CVE-2026-14904: AWS Research and Engineering Studio Arbitrary File Read in Auth.GetUserPrivateKey](https://junglewise.ai/threats/cve-2026-14904-aws-research-and-engineering-studio-arbitrary-file-read-in-auth) (high, CVSS 6.5, published 7 Jul 2026) - [CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder](https://junglewise.ai/threats/cve-2026-89090-aws-sdk-for-go-v2-denial-of-service-in-eventstream-header-decoder) (high, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-14265: AWS Advanced JDBC Wrapper RCE in RemoteQueryCachePlugin](https://junglewise.ai/threats/cve-2026-14265-aws-advanced-jdbc-wrapper-rce-in-remotequerycacheplugin) (high, CVSS 7.5, published 1 Jul 2026) - [CVE-2026-13769: AWS AWS CLI insecure file permissions in credential subcommands](https://junglewise.ai/threats/cve-2026-13769-aws-aws-cli-insecure-file-permissions-in-credential-subcommands) (high, CVSS 5.5, published 1 Jul 2026) - [CVE-2026-13762: AWS CloudFront WAF bypass via HTTP/2 request body fragmentation](https://junglewise.ai/threats/cve-2026-13762-aws-cloudfront-waf-bypass-via-http-2-request-body-fragmentation) (critical, CVSS 9.8, published 29 Jun 2026) - [CVE-2026-12958: AWS Language Servers arbitrary file write via symlink validation bypass](https://junglewise.ai/threats/cve-2026-12958-aws-language-servers-arbitrary-file-write-via-symlink-validation) (high, CVSS 7.8, published 23 Jun 2026) - [CVE-2026-12957: AWS Language Servers arbitrary code execution in trusted workspaces](https://junglewise.ai/threats/cve-2026-12957-aws-language-servers-arbitrary-code-execution-in-trusted) (high, CVSS 7.8, published 23 Jun 2026) - [CVE-2026-12043: AWS aws-c-http memory corruption in HPACK resizing](https://junglewise.ai/threats/cve-2026-12043-aws-aws-c-http-memory-corruption-in-hpack-resizing) (high, CVSS 8.8, published 12 Jun 2026) - [CVE-2026-11400: AWS Advanced JDBC Wrapper privilege escalation in GlobalDatabasePlugin](https://junglewise.ai/threats/cve-2026-11400-aws-advanced-jdbc-wrapper-privilege-escalation-in) (high, CVSS 8, published 5 Jun 2026) - [CVE-2026-10584: AWS Graph Explorer cleartext transmission via HTTPS fallback](https://junglewise.ai/threats/cve-2026-10584-aws-graph-explorer-cleartext-transmission-via-https-fallback) (high, CVSS 5.9, published 2 Jun 2026) - [CVE-2026-9291: AWS Amazon Braket Python SDK insecure deserialization in job results processing](https://junglewise.ai/threats/cve-2026-9291-aws-amazon-braket-python-sdk-insecure-deserialization-in-job) (high, CVSS 7.1, published 22 May 2026) - [CVE-2026-9255: Amazon Kiro CLI unauthorized command execution via piped stdin](https://junglewise.ai/threats/cve-2026-9255-amazon-kiro-cli-unauthorized-command-execution-via-piped-stdin) (high, CVSS 7.8, published 22 May 2026) ## Most severe Amazon Web Services vulnerabilities - [CVE-2026-122193: AWS Trusted Remote Execution OS command injection in SSM document](https://junglewise.ai/threats/cve-2026-122193-os-command-injection-in-the-example-ssm-document-provisioning) (critical, CVSS 9.9, published 6 Nov 2026) - [CVE-2026-8838: AWS amazon-redshift-python-driver code injection in vector_in](https://junglewise.ai/threats/cve-2026-8838-aws-amazon-redshift-python-driver-code-injection-in-vector-in) (critical, CVSS 9.8, published 18 May 2026) - [CVE-2026-6911: AWS Ops Wheel auth bypass and privilege escalation in v2 API](https://junglewise.ai/threats/cve-2026-6911-aws-ops-wheel-auth-bypass-and-privilege-escalation-in-v2-api) (critical, CVSS 9.8, published 24 Apr 2026) - [CVE-2026-115812: Amazon Web Services Multi Model Server path traversal and SSRF](https://junglewise.ai/threats/cve-2026-115812-and-issue-in-amazon-web-services-multi-model-server) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2026-13762: AWS CloudFront WAF bypass via HTTP/2 request body fragmentation](https://junglewise.ai/threats/cve-2026-13762-aws-cloudfront-waf-bypass-via-http-2-request-body-fragmentation) (critical, CVSS 9.8, published 29 Jun 2026) - [CVE-2026-5708: AWS Research and Engineering Studio privilege escalation in session creation](https://junglewise.ai/threats/cve-2026-5708-aws-research-and-engineering-studio-privilege-escalation-in) (high, CVSS 8.8, published 6 Apr 2026) - [CVE-2026-12043: AWS aws-c-http memory corruption in HPACK resizing](https://junglewise.ai/threats/cve-2026-12043-aws-aws-c-http-memory-corruption-in-hpack-resizing) (high, CVSS 8.8, published 12 Jun 2026) - [CVE-2026-7424: Amazon FreeRTOS-Plus-TCP integer underflow in DHCPv6 parser](https://junglewise.ai/threats/cve-2026-7424-amazon-freertos-plus-tcp-integer-underflow-in-dhcpv6-parser) (high, CVSS 8.1, published 29 Apr 2026) - [CVE-2026-11400: AWS Advanced JDBC Wrapper privilege escalation in GlobalDatabasePlugin](https://junglewise.ai/threats/cve-2026-11400-aws-advanced-jdbc-wrapper-privilege-escalation-in) (high, CVSS 8, published 5 Jun 2026) - [CVE-2026-15895: AWS jsii-diff OS command injection in npm package loading](https://junglewise.ai/threats/cve-2026-15895-aws-jsii-diff-os-command-injection-in-npm-package-loading) (high, CVSS 7.8, published 15 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 4 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 1 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Amazon Web Services technologies - [Amazon Web Services FreeRTOS-Plus-TCP](https://junglewise.ai/threats/technologies/freertos-plus-tcp): 4 vulnerabilities - [Amazon Web Services Aws-C-Io](https://junglewise.ai/threats/technologies/aws-c-io): 3 vulnerabilities - [Amazon Web Services AWS IoT Device SDK v2 for C++](https://junglewise.ai/threats/technologies/aws-iot-device-sdk-v2-for-c): 3 vulnerabilities - [Amazon Web Services AWS IoT Device SDK v2 for Java](https://junglewise.ai/threats/technologies/aws-iot-device-sdk-v2-for-java): 3 vulnerabilities - [Amazon Web Services AWS IoT Device SDK v2 for Node.js](https://junglewise.ai/threats/technologies/aws-iot-device-sdk-v2-for-node-js): 3 vulnerabilities - [Amazon Web Services AWS IoT Device SDK v2 for Python](https://junglewise.ai/threats/technologies/aws-iot-device-sdk-v2-for-python): 3 vulnerabilities - [Amazon Web Services Research and Engineering Studio](https://junglewise.ai/threats/technologies/research-and-engineering-studio): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Amazon Web Services vulnerabilities", https://junglewise.ai/threats/vendors/amazon-web-services, 12 November 2026.