# Amazon Web Services in October 2026: incidents, uptime and changes

> Amazon Web Services in October 2026: 2 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 48 CVEs. From Rewindex’s archive of Amazon Web Services’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/aws/2026/10
Last updated: 2026-11-04T12:53:08Z

- Incidents posted: 2 (major/critical: 0) · Maintenance: 0
- By vendor impact label: minor 2
- Uptime (vendor-reported): 100% free of major/critical incidents, 99.63% free of any incident; outage time 0 min, incident time 2 h 42 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 48
- Previous month: [September 2026](https://rewindex.com/company/aws/2026/09.md) · Next: [November 2026](https://rewindex.com/company/aws/2026/11.md) · [All months](https://rewindex.com/company/aws/reports.md) · [Amazon Web Services](https://rewindex.com/company/aws.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Elevated packet loss (eu-south-2)](https://rewindex.com/company/aws/incidents/eu-south-2-aws_internetconnectivity_operational_issue_f4dc4_40592306093.md) | minor | 2026-10-04 16:14 UTC | 2026-10-04 18:56 UTC | 2.7 h | resolved |
| [Increased invoke error rates (us-west-2)](https://rewindex.com/company/aws/incidents/us-west-2-aws_apigateway_operational_issue_63501_d2c0654f167.md) | minor | 2026-10-30 01:28 UTC | 2026-10-30 01:28 UTC | 0 min | resolved |

## CVEs published

- [CVE-2026-103505](https://rewindex.com/cve/CVE-2026-103505.md) AWS EFS CSI Driver Mount Option Injection via mounttargetipmap (CVSS 6.5), published 2026-10-01
- [CVE-2026-97662](https://rewindex.com/cve/CVE-2026-97662.md) Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace (CVSS 8.2), published 2026-10-01
- [CVE-2026-104020](https://rewindex.com/cve/CVE-2026-104020.md) Uncontrolled recursion in the Ion reader in Amazon Ion Python (CVSS 7.5), published 2026-10-01
- [CVE-2026-104002](https://rewindex.com/cve/CVE-2026-104002.md) Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) (CVSS 5.3), published 2026-10-01
- [CVE-2026-103956](https://rewindex.com/cve/CVE-2026-103956.md) Missing authentication for critical function in Loom for AWS (CVSS 10.0), published 2026-10-02
- [CVE-2026-103957](https://rewindex.com/cve/CVE-2026-103957.md) Server-side request forgery in the OAuth2 discovery handling in Loom for AWS (CVSS 6.2), published 2026-10-02
- [CVE-2026-103958](https://rewindex.com/cve/CVE-2026-103958.md) Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS (CVSS 7.6), published 2026-10-02
- [CVE-2026-104019](https://rewindex.com/cve/CVE-2026-104019.md) OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio (CVSS 9.0), published 2026-10-02
- [CVE-2026-105811](https://rewindex.com/cve/CVE-2026-105811.md) Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS (CVSS 6.5), published 2026-10-06
- [CVE-2026-105812](https://rewindex.com/cve/CVE-2026-105812.md) Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import (CVSS 9.0), published 2026-10-06
- [CVE-2026-106032](https://rewindex.com/cve/CVE-2026-106032.md) Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import (CVSS 5.7), published 2026-10-06
- [CVE-2026-107352](https://rewindex.com/cve/CVE-2026-107352.md) Missing authorization checks in Amazon Athena engine version 3 request handling (CVSS 7.7), published 2026-10-07
- [CVE-2026-107332](https://rewindex.com/cve/CVE-2026-107332.md) Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code (CVSS 5.5), published 2026-10-08
- [CVE-2026-107322](https://rewindex.com/cve/CVE-2026-107322.md) OS command injection in Amazon Agent Plugins for AWS databases-on-aws (CVSS 7.8), published 2026-10-08
- [CVE-2026-107608](https://rewindex.com/cve/CVE-2026-107608.md) Improper link resolution in asset bundling output handling in aws-cdk-lib (CVSS 5.5), published 2026-10-08
- [CVE-2026-107783](https://rewindex.com/cve/CVE-2026-107783.md) Insertion of sensitive information into log file in AWS Tools for PowerShell (CVSS 5.9), published 2026-10-09
- [CVE-2026-108096](https://rewindex.com/cve/CVE-2026-108096.md) Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category (CVSS 6.5), published 2026-10-09
- [CVE-2026-110248](https://rewindex.com/cve/CVE-2026-110248.md) Insertion of sensitive information into log files in Amazon SageMaker Python SDK git\_utils\[.\]py (CVSS 5.3), published 2026-10-14
- [CVE-2026-110310](https://rewindex.com/cve/CVE-2026-110310.md) RSA PKCS\#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET (CVSS 5.3), published 2026-10-14
- [CVE-2026-98432](https://rewindex.com/cve/CVE-2026-98432.md) ipv4: free inet\_opt and ireq\_opt after an RCU grace period (CVSS 9.8), published 2026-10-15
- [CVE-2026-110812](https://rewindex.com/cve/CVE-2026-110812.md) Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune (CVSS 9.9), published 2026-10-15
- [CVE-2026-109587](https://rewindex.com/cve/CVE-2026-109587.md) Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel (CVSS 8.8), published 2026-10-16
- [CVE-2026-109588](https://rewindex.com/cve/CVE-2026-109588.md) Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel (CVSS 8.8), published 2026-10-16
- [CVE-2026-102551](https://rewindex.com/cve/CVE-2026-102551.md) Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling (CVSS 7.7), published 2026-10-16
- [CVE-2026-102552](https://rewindex.com/cve/CVE-2026-102552.md) Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver (CVSS 5.9), published 2026-10-16
- [CVE-2026-112380](https://rewindex.com/cve/CVE-2026-112380.md) Missing authorization in the WhatsApp channel in Kiro Crew (CVSS 9.9), published 2026-10-20
- [CVE-2026-112407](https://rewindex.com/cve/CVE-2026-112407.md) Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications (CVSS 8.8), published 2026-10-20
- [CVE-2026-111943](https://rewindex.com/cve/CVE-2026-111943.md) Distrust compromised intermediate certificates in crypto/x509 (CVSS 6.8), published 2026-10-21
- [CVE-2026-109618](https://rewindex.com/cve/CVE-2026-109618.md) RCE via OOM corruption (CVSS 9.8, CISA KEV), published 2026-10-21
- [CVE-2026-109619](https://rewindex.com/cve/CVE-2026-109619.md) RCE via stale global state (CVSS 8.1, CISA KEV), published 2026-10-21
- [CVE-2026-112408](https://rewindex.com/cve/CVE-2026-112408.md) Missing bucket ownership verification in Amazon SageMaker Python SDK default\_bucket() (CVSS 8.1), published 2026-10-21
- [CVE-2026-111497](https://rewindex.com/cve/CVE-2026-111497.md) Out-of-Bounds Write in Google Brotli Decoder (CVSS 9.8, CISA KEV), published 2026-10-22
- [CVE-2026-115416](https://rewindex.com/cve/CVE-2026-115416.md) Incorrect authorization checks in Amazon Athena engine version 3 query processing (CVSS 7.7), published 2026-10-22
- [CVE-2026-115414](https://rewindex.com/cve/CVE-2026-115414.md) OS command injection in the Terraform hook in AWS SAM CLI (CVSS 7.8), published 2026-10-22
- [CVE-2026-115419](https://rewindex.com/cve/CVE-2026-115419.md) Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server (CVSS 8.1), published 2026-10-22
- [CVE-2026-115417](https://rewindex.com/cve/CVE-2026-115417.md) Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt (CVSS 7.5), published 2026-10-22
- [CVE-2026-115812](https://rewindex.com/cve/CVE-2026-115812.md) Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server (CVSS 9.8), published 2026-10-23
- [CVE-2026-115813](https://rewindex.com/cve/CVE-2026-115813.md) Server-side request forgery in the model download path in Amazon Web Services Multi Model Server (CVSS 5.8), published 2026-10-23
- [CVE-2026-115845](https://rewindex.com/cve/CVE-2026-115845.md) Incomplete validation in the run\_script Python sandbox in AWS MCP Server (CVSS 6.4), published 2026-10-23
- [CVE-2026-115418](https://rewindex.com/cve/CVE-2026-115418.md) SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha (CVSS 7.3), published 2026-10-26
- [CVE-2026-115413](https://rewindex.com/cve/CVE-2026-115413.md) AWS API MCP Server OAuth Token Audience Validation Bypass (CVSS 7.8), published 2026-10-27
- [CVE-2026-118029](https://rewindex.com/cve/CVE-2026-118029.md) Unverified ownership of the default Athena query result location in AWS SDK for pandas (CVSS 5.9), published 2026-10-28
- [CVE-2026-115415](https://rewindex.com/cve/CVE-2026-115415.md) Secret masking bypass in the environment tool in Strands Agents Tools (CVSS 6.5), published 2026-10-28
- [CVE-2026-119115](https://rewindex.com/cve/CVE-2026-119115.md) Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes (CVSS 8.5), published 2026-10-29
- [CVE-2026-119116](https://rewindex.com/cve/CVE-2026-119116.md) Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c (CVSS 7.8), published 2026-10-30
- [CVE-2026-119148](https://rewindex.com/cve/CVE-2026-119148.md) Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint (CVSS 6.5), published 2026-10-30
- [CVE-2026-119086](https://rewindex.com/cve/CVE-2026-119086.md) Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel (CVSS 6.5), published 2026-10-30
- [CVE-2026-119117](https://rewindex.com/cve/CVE-2026-119117.md) Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java (CVSS 6.5), published 2026-10-30

## Cite this

Amazon Web Services posted 2 status incidents in October 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/aws/2026/10
- Citation: Amazon Web Services, “Amazon Web Services in October 2026” (2026-10-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/aws/2026/10 (CC BY 4.0).
- Markdown link: `[Amazon Web Services: Amazon Web Services in October 2026 (2026-10-01)](https://rewindex.com/company/aws/2026/10)`


---
Canonical: https://rewindex.com/company/aws/2026/10 · Markdown: https://rewindex.com/company/aws/2026/10.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T14:10:35.457Z