What’s Vulnerable › Vulnerabilities

CVE-2026-5707: Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-06 · updated 2026-07-24
• Weakness: CWE-78

Description

Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

Affected products

• AWS Research and Engineering Studio (RES): before 2026.03 — fixed in 2026.03

How to fix

Upgrade to a fixed version: AWS Research and Engineering Studio (RES) 2026.03. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-014-aws/
• https://github.com/aws/res/issues/151
• https://github.com/aws/res/releases/tag/2026.03

Get alerted when CVE-2026-5707 or the next vulnerability affects your stack