What’s Vulnerable › Vulnerabilities
CVE-2026-7791: Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-04 · updated 2026-10-26
- Weakness: CWE-367
Description
Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file system permission protections, leading to local privilege escalation to SYSTEM.
Affected products
- Amazon Workspaces: before 2.6.2034.0 — fixed in 2.6.2034.0
How to fix
Upgrade to a fixed version: Amazon Workspaces 2.6.2034.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-7791 or the next vulnerability affects your stack