# Amazon Web Services in September 2026: incidents, uptime and changes

> Amazon Web Services in September 2026: 2 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 25 CVEs. From Rewindex’s archive of Amazon Web Services’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/aws/2026/09
Last updated: 2026-10-20T19:19:24Z

- Incidents posted: 2 (major/critical: 0) · Maintenance: 0
- By vendor impact label: minor 2
- Uptime (vendor-reported): 100% free of major/critical incidents, 99.54% free of any incident; outage time 0 min, incident time 3 h 15 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 25
- Previous month: [August 2026](https://rewindex.com/company/aws/2026/08.md) · Next: [October 2026](https://rewindex.com/company/aws/2026/10.md) · [All months](https://rewindex.com/company/aws/reports.md) · [Amazon Web Services](https://rewindex.com/company/aws.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Increased API Error Rates (us-west-2)](https://rewindex.com/company/aws/incidents/us-west-2-aws_multiple_services_operational_issue_926db_f0036494ea4.md) | minor | 2026-09-03 21:49 UTC | 2026-09-04 00:07 UTC | 2.3 h | resolved |
| [Increased Error Rates (us-east-1)](https://rewindex.com/company/aws/incidents/us-east-1-aws_ec2_operational_issue_79073_047629764f9.md) | minor | 2026-09-21 23:26 UTC | 2026-09-22 00:24 UTC | 58 min | resolved |

## CVEs published

- [CVE-2026-83551](https://rewindex.com/cve/CVE-2026-83551.md) Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path (CVSS 7.2), published 2026-09-01
- [CVE-2026-85012](https://rewindex.com/cve/CVE-2026-85012.md) OS command injection in the Amazon CodeCatalyst blueprints SDK (CVSS 8.0), published 2026-09-03
- [CVE-2026-85028](https://rewindex.com/cve/CVE-2026-85028.md) Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit (CVSS 7.8), published 2026-09-03
- [CVE-2026-85781](https://rewindex.com/cve/CVE-2026-85781.md) Unverified access point ownership in Amazon EFS CSI Driver (CVSS 8.7), published 2026-09-04
- [CVE-2026-85787](https://rewindex.com/cve/CVE-2026-85787.md) An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 6.5), published 2026-09-04
- [CVE-2026-84942](https://rewindex.com/cve/CVE-2026-84942.md) Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards (CVSS 8.7), published 2026-09-08
- [CVE-2026-85788](https://rewindex.com/cve/CVE-2026-85788.md) Incomplete list of disallowed inputs in awslabs mysql-mcp-server (CVSS 5.5), published 2026-09-09
- [CVE-2026-87911](https://rewindex.com/cve/CVE-2026-87911.md) Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 9.6), published 2026-09-09
- [CVE-2026-87912](https://rewindex.com/cve/CVE-2026-87912.md) Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops (CVSS 5.9), published 2026-09-10
- [CVE-2026-87913](https://rewindex.com/cve/CVE-2026-87913.md) Missing S3 bucket ownership verification in the AWS Security Agent MCP server (CVSS 5.9), published 2026-09-10
- [CVE-2026-85228](https://rewindex.com/cve/CVE-2026-85228.md) Integer overflow in tensor buffer validation in Deep Java Library (CVSS 9.1), published 2026-09-10
- [CVE-2026-89049](https://rewindex.com/cve/CVE-2026-89049.md) Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent (CVSS 9.9), published 2026-09-10
- [CVE-2026-89065](https://rewindex.com/cve/CVE-2026-89065.md) Relative path traversal in the generated file manifest cleanup component in projen (CVSS 7.1), published 2026-09-11
- [CVE-2026-89066](https://rewindex.com/cve/CVE-2026-89066.md) OS command injection in the task synthesis component in projen (CVSS 7.8), published 2026-09-11
- [CVE-2026-18061](https://rewindex.com/cve/CVE-2026-18061.md) Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin (CVSS 5.9), published 2026-09-11
- [CVE-2026-89090](https://rewindex.com/cve/CVE-2026-89090.md) Denial of service in the event stream header decoder in AWS SDK for Go v2 (CVSS 5.9), published 2026-09-11
- [CVE-2026-89332](https://rewindex.com/cve/CVE-2026-89332.md) Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration (CVSS 5.5), published 2026-09-11
- [CVE-2026-86830](https://rewindex.com/cve/CVE-2026-86830.md) Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (CVSS 7.2), published 2026-09-14
- [CVE-2026-86831](https://rewindex.com/cve/CVE-2026-86831.md) Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS (CVSS 8.7), published 2026-09-16
- [CVE-2026-92943](https://rewindex.com/cve/CVE-2026-92943.md) Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python (CVSS 8.1), published 2026-09-17
- [CVE-2026-94384](https://rewindex.com/cve/CVE-2026-94384.md) Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda (CVSS 8.1), published 2026-09-22
- [CVE-2026-94450](https://rewindex.com/cve/CVE-2026-94450.md) Potential denial of service when configured to send Retry packets in s2n-quic (CVSS 7.5), published 2026-09-22
- [CVE-2026-95985](https://rewindex.com/cve/CVE-2026-95985.md) Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces (CVSS 8.8), published 2026-09-24
- [CVE-2026-96883](https://rewindex.com/cve/CVE-2026-96883.md) Type confusion in AWS pgcollection allows remote code execution (CVSS 8.8), published 2026-09-24
- [CVE-2026-100308](https://rewindex.com/cve/CVE-2026-100308.md) GluonTS arbitrary command execution during model deserialization (CVSS 7.8), published 2026-09-29

## Cite this

Amazon Web Services posted 2 status incidents in September 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/aws/2026/09
- Citation: Amazon Web Services, “Amazon Web Services in September 2026” (2026-09-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/aws/2026/09 (CC BY 4.0).
- Markdown link: `[Amazon Web Services: Amazon Web Services in September 2026 (2026-09-01)](https://rewindex.com/company/aws/2026/09)`


---
Canonical: https://rewindex.com/company/aws/2026/09 · Markdown: https://rewindex.com/company/aws/2026/09.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T11:04:44.456Z