AWS Research and Engineering Studio Flaws Enable Root Command Execution and AWS Privilege Escalation
Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Apr 6, 2026
AWS disclosed two high-severity vulnerabilities in Research and Engineering Studio (RES) that affect releases from 2025.03 through versions prior to 2026.03. The first, CVE-2026-5707, is a CWE-78 command injection flaw in virtual desktop session name handling that could let a remote authenticated attacker execute arbitrary commands as root on a virtual desktop host by supplying a crafted session name. The issue carries a CVSS v3.1 rating of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high impact across confidentiality, integrity, and availability.
AWS also disclosed CVE-2026-5708, a CWE-915 privilege-escalation flaw in the RES CreateSession API caused by improper control of user-modifiable attributes. An authenticated attacker could use a crafted API request to escalate privileges, assume the virtual desktop host instance profile permissions, and access AWS resources and services. AWS directed customers to upgrade to RES 2026.03 or apply the vendor mitigation patch, with details published through an AWS security bulletin, a GitHub issue, and the RES 2026.03 release notes.
