Amazon Web Services — IAM, EC2, S3, and the rest.
CVE-2026-119084 is a remote code execution vulnerability in Amazon Redshift JDBC Driver versions prior to 2.3.0. The driver can load and execute arbitrary classes when processing JDBC connection URL parameters or AWS credentials profile fields under certain conditions. AWS recommends users upgrade to version 2.3.0 or later.
CVE-2026-116635 is a medium-severity (CVSS 6.1) path traversal vulnerability in AWS Serverless MCP Server before v0.2.1. The flaw in the deployment status component allows an attacker who can influence the MCP agent to read JSON files outside the intended directory or, with write access, create or overwrite files outside that directory using directory traversal sequences or absolute paths. No public exploit is currently known.
CVE-2026-119085 is a high-severity (CVSS 8.8) template injection vulnerability in AWS Virtual Engineering Workbench. A remote authenticated attacker can exploit improper neutralization of special elements in the template engine to execute arbitrary code with the permissions of the publishing Lambda's IAM role, potentially accessing data and resources across all tenant projects. A patch is available.
CVE-2026-98432, a critical Linux kernel use-after-free vulnerability in IPv4 TCP handling, affects Amazon Linux and other Linux distributions used in AWS EC2. The flaw allows remote attackers to crash systems or achieve remote code execution when specific conditions (such as an MPTCP listener) are present. Researchers demonstrated reliable remote root execution in lab conditions. AWS customers should apply kernel patches and reboot affected instances.
Critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are under active exploitation in the wild. Amazon Threat Intelligence reports attacks began four days before patches were released on October 21, 2026. Cloudflare detected millions of exploit attempts post-disclosure, with attackers actively adapting payloads to bypass web application firewall protections. AWS deployed WAF mitigation rules and provides guidance on using AWS WAF to protect against these flaws.
Amazon Bedrock AgentCore contained a vulnerability allowing attackers to steal temporary AWS credentials and access agent source code through prompt-injection-triggered SSRF attacks exploiting IMDSv1. An overpermissioned default IAM role amplified the risk, enabling access to other agents, ECR images, and user sessions within the account. AWS patched IMDSv1 by February 2026 and addressed IAM permissions by September 2026.
CVE-2026-94384 is an IAM bypass vulnerability in AWS Lambda's AmazonConnectSalesforceLambda integration (versions 5.15–5.24.16). The sfExecuteAWSService function fails to validate caller permissions, allowing any IAM principal with lambda:InvokeFunction access to invoke the privileged function and execute AWS API operations their own identity is denied. AWS patched the flaw in June 2026 and published an advisory in September 2026; CVSS base score is 8.1 (High).
AWS released security patches for four vulnerabilities affecting Loom AI agent orchestration platform and Amazon SageMaker Unified Studio, disclosed on October 2, 2026. The flaws include missing authentication (CVE-2026-103956), OAuth2 token disclosure (CVE-2026-103957), internal network access via SSRF (CVE-2026-103958), and OS command injection in SageMaker startup scripts (CVE-2026-104019). Attackers could bypass authentication, steal credentials and OAuth2 tokens, access internal services, and execute arbitrary code. AWS recommends immediate upgrades to Loom 1.7.0 and restarting affected SageMaker Studio Spaces.
Attackers are actively exploiting CVE-2026-0768, an unauthenticated remote code execution vulnerability in Langflow, to harvest AWS credentials from compromised instances. VulnCheck telemetry recorded 360+ exploitation detections within 48 hours as of September 2026. Adversaries extract AWS access and secret keys from environment variables, deploy cryptominers, and perform lateral movement across affected networks. The vulnerability, with CVSS score 9.8, remains actively weaponized alongside 11 other Langflow CVEs exploited in the wild throughout 2026.
ShinyHunters threat group exploited a zero-day vulnerability in Oracle PeopleSoft to compromise the FBI jobs website and gain access to AWS GovCloud instances, exfiltrating approximately 2 TB of employee data. The group threatens to release the data including information on FBI employees and their family members unless the FBI retracts previous statements about their activities. This represents active exploitation of a critical vulnerability affecting US government infrastructure.
JetBrains Cadence service was compromised via CVE-2026-63077, an unauthenticated remote-code-execution vulnerability in TeamCity's agent polling protocol (CVSS 9.8). Attackers exploited the flaw between August 8–24, 2026, to access a 2024 Cadence backup containing AWS IAM credentials. The breach exposed source code, configuration files, and project metadata in JetBrains S3 buckets; attackers may also have accessed customer-owned AWS buckets configured with Cadence. JetBrains confirmed the vulnerability was unpatched on its own server for 16 days despite a public advisory on July 27, 2026.
CVE-2026-39987 in marimo notebook tool allows unauthenticated remote code execution via an unprotected WebSocket endpoint (/terminal/ws). Threat actors are actively exploiting this vulnerability to steal AWS credentials from compromised instances, retrieve SSH private keys from AWS Secrets Manager, and pivot to internal bastion hosts. Affected marimo versions up to 0.20.4; fixed in 0.23.0. A documented intrusion shows credential theft and bastion access achieved within 8 seconds.
CVE-2026-39364 in Vite development servers enables unauthenticated file-read access. Attackers are actively scanning exposed Vite servers to extract AWS credentials, Azure tokens, and infrastructure data from .env files and deployment artifacts. Honeynet recorded over 807 session-grouped attacks in August 2026. Affected Vite versions 7.1.0–7.3.2 and 8.0.5; attackers use query-parameter bypasses to circumvent file-access restrictions.
CVE-2026-89049 in AWS Systems Manager Agent allows authenticated attackers to bypass port-forwarding restrictions on link-local addresses and access the EC2 Instance Metadata Service, potentially retrieving temporary IAM credentials. Affects versions prior to 3.3.4851.0. AWS recommends immediate patching and restricting access to the AWS-StartPortForwardingSessionToRemoteHost document until systems are updated.
Between August 8 and August 24, 2026, attackers exploited CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity, to breach JetBrains Cadence cloud compute service. The attackers extracted AWS IAM credentials from JetBrains AWS accounts, source code, configuration files, and secrets stored in backups and S3 buckets. The vulnerability (CVSS 9.8) affects all TeamCity On-Premises versions prior to 2025.11.7 or 2026.1.3 and was publicly disclosed August 5, 2026.
CVE-2026-83551 in AWS SageMaker Python SDK before v3.11.0 and v2.256.0 stores HMAC signing keys in cleartext within pipeline decorator components. Authenticated remote users can extract keys from DescribePipeline API responses and forge valid signatures for malicious function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
CVE-2026-83497 is a high-severity vulnerability (CVSS 8.8) in the OpenSearch SQL plugin affecting AWS OpenSearch. Unrestricted deserialization of untrusted data in the cursor pagination component allows remote authenticated users with basic read/search permissions to execute arbitrary code on the server via a crafted cursor parameter.
AWS patched a widespread input validation flaw across seven SDKs (Python, Ruby, Go, Java, Node.js, PHP, .NET) that allowed attackers to hijack region parameters in hostnames and redirect API calls to attacker-controlled servers. The flaw particularly affects AssumeRoleWithWebIdentity calls, leaking plaintext bearer tokens and AWS credentials from EKS workloads, Cognito applications, and OIDC integrations. Discovered by Pi Inc., the vulnerability was reported October 2025 and patched by January 2026; only the .NET SDK received a CVE (CVE-2026-22611, rated 3.7/10).
A critical SSRF vulnerability (CVE-2026-64849) in MLflow is being actively exploited to steal cloud credentials from AWS, GCP, and Azure environments. Unauthenticated attackers craft malicious webhook payloads to force MLflow servers to access cloud metadata endpoints, exfiltrating sensitive credentials and tokens. Multiple organizations across technology, finance, healthcare, and government sectors have confirmed compromise. CISA has listed the vulnerability in its Known Exploited Vulnerabilities catalog. Remediation requires immediate upgrade to MLflow 3.15.0 and isolation of MLflow servers from public internet access.
A 153GB archive of stolen credentials from the LiteLLM AI framework breach exposed access credentials for 2,488 corporate domains, including AWS, Samsung, and Cisco. The compromised credentials originated from a breach of the LiteLLM open-source AI framework and were publicly surfaced in August 2026. Organizations using AWS should audit access logs and rotate exposed credentials.
AWS Bedrock AgentCore InvokeHarness API (CVE-2026-18830, CVSS 8.6) allows authenticated remote attackers to bypass model authorization and invoke tools directly. AWS patched the managed service on July 31, 2026, but declined to issue a code fix for the underlying Strands Python SDK, leaving standalone deployments vulnerable to model-skipping attacks via caller-supplied tool-use blocks.
Aryon Security research reveals 'ShutterGap,' a cloud-security blind spot affecting millions of AWS resources. RDS snapshots, DocumentDB snapshots, AMIs, and SSM documents are being briefly exposed publicly before removal, often within minutes. Security tools relying on periodic scans miss these short-lived exposures, while attackers can discover and copy data in seconds. 20% of exposed RDS snapshots appear and vanish in under two minutes, enabling rapid data exfiltration before detection.
AWS disclosed CVE-2026-15746, an SSRF vulnerability in the strands-agents-tools package (an open-source Python SDK for building AI agents). The elasticsearch_memory tool allows large language models to control connection parameters, enabling a crafted prompt to exfiltrate the operator's Elasticsearch API key to an attacker-controlled server. AWS recommends upgrading to version 0.7.0 or later and rotating all ELASTICSEARCH_API_KEY credentials as a precautionary measure.
CISA disclosed an internal security incident in which AWS GovCloud administrator credentials were exposed in a public GitHub repository maintained by a Nightwing contractor since November 2025. The repository contained Infrastructure as Code, build automation scripts, and plaintext admin credentials for three AWS GovCloud servers and internal CISA systems. Discovery occurred May 15, 2026 via external reporting; forensic analysis found no evidence the leaked credentials were used outside CISA environments, and no customer or mission data was compromised. CISA remediated by taking the repository offline, rotating credentials across all affected environments, and implementing repository upload controls and secrets management safeguards.
An AWS customer's LiteLLM-Proxy EC2 instance, functioning as an AI gateway to Amazon Bedrock, was compromised on June 12, 2026 via brute-force attacks against an exposed SSH port (0.0.0.0/0). Attackers deployed XMRig cryptomining malware and established persistence through the instance's privileged IAM role. Suspicious IAM activity detected a day later suggested possible credential misuse targeting Amazon Bedrock services. Darktrace's managed threat detection alerted the customer.
A lone attacker breached an AWS customer's cloud environment in 72 hours by exploiting AI workflows, chaining cloud configuration weaknesses, and using stolen credentials. The attacker accessed data and attempted extortion against the compromised Amazon customer.
Two high-severity vulnerabilities (CVE-2026-12957, CVE-2026-12958) in Amazon Q Developer Extension for VS Code and other IDEs allowed remote code execution and AWS credential theft when developers opened malicious repositories containing an `.amazonq/mcp.json` file. The extension auto-loaded MCP server configurations without user consent, enabling attackers to exfiltrate AWS credentials, API keys, and SSH agent sockets. Patches available in Language Servers for AWS 1.69.0 and corresponding IDE extensions.
Unit 42 researchers documented active attack techniques where threat actors disable or manipulate AWS CloudTrail logging to evade detection. Attackers can invoke the CloudTrail StopLogging API, delete log storage destinations, manipulate KMS encryption keys to render logs inaccessible, or redirect logs to attacker-controlled environments for persistent visibility. Organizations should enforce strict access controls on logging resources and leverage immutable log features.
A campaign tracked under Langflow vulnerability CVE-2026-33017 is being actively exploited to steal AWS access keys from compromised Langflow instances and enlist victim systems as workers in a NATS-based botnet. The flaw resides in Langflow, a third-party open-source AI workflow tool, but exposed deployments commonly hold AWS credentials used to wire Langflow into cloud services, making AWS customers running Langflow the primary loot target. Reporting describes ongoing in-the-wild exploitation of internet-exposed Langflow servers, with attackers exfiltrating cloud keys and deploying secondary payloads. AWS customers operating Langflow should patch to the fixed version, audit IAM credentials configured in Langflow flows, rotate any keys that may have been exposed, and review CloudTrail for anomalous activity originating from those keys. This is distinct from prior AWS-related advisories tracked in recent alerts.
AI observability startup Braintrust disclosed that an attacker gained unauthorized access to one of its AWS accounts, potentially exposing customer secrets used to connect Braintrust to cloud-based AI providers. The company detected suspicious activity on May 4, 2026, locked down the affected account, rotated internal credentials, restricted access to related systems, and engaged incident response experts. Braintrust has confirmed impact to one customer and is investigating suspicious AI-provider usage spikes reported by three additional customers, though it says broader exposure has not been identified. All organization administrators with stored AI provider keys were notified, and customers are urged to rotate any org-level AI provider keys used with Braintrust as a precaution. The incident illustrates AI supply chain risk, since stolen API keys can let attackers abuse downstream AI services while appearing as legitimate users.