CVE-2026-5708
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
Risk Assessment
An authenticated attacker can escalate privileges and gain unauthorized access to AWS resources, potentially leading to data breaches or further attacks.
Recommendation
Update AWS RES to version 2026.03 or apply the corresponding mitigation patch.
Other vulnerabilities in AWS Research and Engineering Studio
See all- CVE-2026-14904Medium
In AWS Research and Engineering Studio (RES), a CWE-59 vulnerability was found due to improper link resolution before file access in the Auth.GetUserPrivateKey API. An authenticated remote user can read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the host.
- CVE-2026-5709High
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
- CVE-2026-5707High
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.
Original NVD description (English source)
Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.