AWS vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 6 AWS CVEs published between 2026-06-15 and 2026-10-15. The busiest month was 2026-10 (4 new CVEs). None of them is listed in CISA KEV yet.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked AWS CVEs.

• CVE-2026-104019critical 9EPSS 1.4%2026-10-02
• CVE-2026-10591high 8.8EPSS 0.7%2026-06-02
• CVE-2026-103956critical 10EPSS 0.5%2026-10-02
• CVE-2026-103957medium 6.2EPSS 0.4%2026-10-02
• CVE-2026-103958high 7.6EPSS 0.3%2026-10-02
• CVE-2026-81838high 7.1EPSS 0.1%2026-08-27

Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 4 distinct AWS products are affected. The most frequently affected:

• loom 3 CVEs
• Kiro IDE 1 CVE
• diagram-as-code 1 CVE
• sagemaker-distribution 1 CVE

Threat activity

3 tracked threat campaigns reference AWS products or exploit AWS CVEs:

• AWS AI Agent Vulnerabilities (Loom, SageMaker Unified Studio) Let Attackers Bypass Authentication and Steal Credentials - CVE-2026-103956, CVE-2026-103957, CVE-2026-103958, CVE-2026-104019CRITICAL2026-10-03
• AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud ScaleMEDIUM2026-08-04
• Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)HIGH2026-07-22

How to prioritise AWS patching

This order follows the data Threadlinqs holds for AWS, not a generic severity checklist:

• No AWS CVE is in CISA KEV yet, so rank by exploit probability instead.
• Outside KEV, the highest EPSS scores are CVE-2026-104019 (1.4%), CVE-2026-10591 (0.7%), CVE-2026-103956 (0.5%).
• 2 CVEs score Critical and 3 High on CVSS v3 (maximum 10, average 8.1); sequence these after KEV and high-EPSS items.
• 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-24 and refresh daily.