CVE-2026-5707
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.
Risk Assessment
An attacker can gain full control over the virtual desktop host, leading to confidentiality and integrity breaches and potential lateral movement.
Recommendation
Immediately upgrade AWS RES to version 2026.03 or apply the mitigation patch.
Other vulnerabilities in AWS Research and Engineering Studio
See all- CVE-2026-14904Medium
In AWS Research and Engineering Studio (RES), a CWE-59 vulnerability was found due to improper link resolution before file access in the Auth.GetUserPrivateKey API. An authenticated remote user can read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the host.
- CVE-2026-5709High
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
- CVE-2026-5708High
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
Original NVD description (English source)
Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.