PatchTheCVEaws command line interface vulnerabilities and fixes
Recent CVEs affecting aws command line interface, with upgrade or downgrade steps. 2 tracked.
aws command line interface has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-03. Highest priority: CVE-2026-18654 (score 39/100).
- CVE-2026-18654 MEDIUM 6.8 UPGRADE Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and
- CVE-2026-13769 MEDIUM 5.5 UPGRADE Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where
FAQ
How do I fix aws command line interface vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is aws command line interface being exploited right now?
None of the tracked aws command line interface CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which aws command line interface CVE should I patch first?
CVE-2026-18654 currently ranks highest (39/100): Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and.