PT-2026-30745 · Amazon Web Services · Research/Engineering Studio

Julianallenderussek · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5707

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01

Description An issue exists in the virtual desktop session name handling that could allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host through a crafted session name. The issue is due to unsanitized input in an OS command.

Recommendations Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-5707

Affected Products

Research/Engineering Studio

References · 7

• https://github.com/aws/res/issues/151 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-014-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5707 · Security Note
• https://github.com/aws/res/releases/tag/2026.03 · Note
• https://twitter.com/CveFindCom/status/2041285692152496543 · Twitter Post
• https://twitter.com/CVEnew/status/2041282879632879683 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041283790283128865 · Twitter Post