Question 1

What is the EOL Risk Score for AWS WAF Classic 1?

Accepted Answer

AWS WAF Classic 1 has an EOL Risk Score™ of 25 out of 100, placing it in the Low risk band. The score is calculated from four factors: EOL Recency (15/40), Attack Surface (10/30), CISA KEV Exposure (0/20), and Extended Support Availability (0/10).

Question 2

Is AWS WAF Classic 1 still supported?

Accepted Answer

AWS WAF Classic 1 is currently supported. End of life is scheduled for October 7, 2026. Plan your migration before that date to avoid security risk.

Question 3

When does AWS WAF Classic 1 reach end of life?

Accepted Answer

AWS WAF Classic 1 reached (or will reach) end of life on October 7, 2026. After this date, no security patches or bug fixes are issued by the vendor.

Question 4

What are the security risks of running AWS WAF Classic 1 after end of life?

Accepted Answer

After end of life, AWS WAF Classic 1 no longer receives security patches. Any newly discovered CVEs remain unpatched indefinitely. Organizations running EOL software also face compliance violations under SOC 2, PCI DSS, HIPAA, and ISO 27001, which require use of supported software versions.