CVE-2026-5709
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
Risk Assessment
An attacker with account access can take over the EC2 instance, potentially compromising the entire research environment and leading to data leakage.
Recommendation
Upgrade AWS RES to version 2026.03 or apply the corresponding mitigation patch. Restrict FileBrowser functionality to trusted users only.
Other vulnerabilities in AWS Research and Engineering Studio
See all- CVE-2026-14904Medium
In AWS Research and Engineering Studio (RES), a CWE-59 vulnerability was found due to improper link resolution before file access in the Auth.GetUserPrivateKey API. An authenticated remote user can read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the host.
- CVE-2026-5708High
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
- CVE-2026-5707High
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.
Original NVD description (English source)
Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.