AWS Research and Engineering Studio vulnerabilities
4 known CVE vulnerabilities in AWS Research and Engineering Studio, translated and rated.
- CVE-2026-14904Medium
In AWS Research and Engineering Studio (RES), a CWE-59 vulnerability was found due to improper link resolution before file access in the Auth.GetUserPrivateKey API. An authenticated remote user can read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link pointing to any file on the host.
- CVE-2026-5709High
Vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Unsanitized input in the FileBrowser API may allow a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance.
- CVE-2026-5708High
A vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03 allows an authenticated remote user to escalate privileges via unsanitized control of attributes in the session component. An attacker can assume the virtual desktop host instance profile permissions and access AWS resources.
- CVE-2026-5707High
In AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01, unsanitized input in virtual desktop session name handling allows a remote authenticated attacker to execute arbitrary commands as root on the virtual desktop host via a crafted session name. Upgrade to version 2026.03 or apply the mitigation patch.