Cloud Vulnerabilities Quadruple Between May and November
Datadog's State of Cloud Security 2026 report found the median number of high or critical flaws in cloud workloads rose from four to 16 over that period.
Updated on Nov. 10, 2026 in Cybersecurity
Datadog reported on November 10, 2026, that the median number of high or critical vulnerabilities in cloud workloads increased fourfold between May and November 2026. The report also found that nearly half of organizations using Gemini rely on long-lived Gemini API keys.
Why it matters
The growing number of vulnerabilities in the CVE database affects a rising share of real-world applications running in cloud environments. Long-lived credentials are consistently ranked among the most common causes of cloud breaches, making them a key exposure point for organizations.
Datadog's analysis of third-party library vulnerabilities across thousands of customer organizations shows the median count of high or critical flaws climbing from four in May 2026 to 16 in November. Nearly 30% of AWS IAM and Google Cloud Service Account users hold access keys older than three years, and the report does not say whether these figures will stabilize.
The players
Datadog
Datadog is a cloud monitoring and security company whose Code Security feature tracks vulnerabilities in third-party software libraries across customer environments.
The details
Datadog analyzed vulnerabilities in third-party libraries used by applications monitored through its Software Composition Analysis feature. The report also found that 60% of organizations run dependency versions released less than 24 hours earlier, and that such versions appear in 21% of cloud applications.
Timeline
May 2026: median high or critical vulnerabilities stood at four.
June 2026: the median rose to 14.
November 10, 2026: Datadog published its State of Cloud Security 2026 report.
November 2026: the median reached 16.
Industry Trend
Datadog's annual State of Cloud Security series has increasingly tracked how quickly workload vulnerabilities accumulate as dependencies multiply. The 2026 figures show that trend accelerating, with the median number of high or critical flaws climbing fourfold in six months.
Organizations using cloud services should review how long their access keys have been active, since nearly 30% of AWS IAM and Google Cloud Service Account users hold keys older than three years. Teams that update third-party dependencies quickly face a different risk, because 60% of organizations run versions released less than 24 hours earlier.
The takeaway
Regularly rotating long-lived credentials and auditing software dependencies can reduce exposure to the rapidly growing pool of cloud vulnerabilities. Monitoring which dependencies your applications rely on is a practical first step.
Further reading
Explore more in Cybersecurity for context on how cloud credential and dependency risks are evolving.
