PT-2026-30745 · Amazon Web Services · Research/Engineering Studio

Julianallenderussek · Published 2026-04-06 · Updated 2026-04-10 · CVE-2026-5707

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01

Description A flaw exists in the virtual desktop session name handling within AWS Research and Engineering Studio (RES). An unsanitized input in an OS command could allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host through a crafted session name.

Recommendations Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

Exploit

Fix

RCE

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-5707

Affected Products

Research/Engineering Studio

References · 10

• 🔥 https://github.com/aws/res/issues/151 · Exploit
• https://aws.amazon.com/security/security-bulletins/2026-014-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5707 · Security Note
• https://github.com/aws/res/releases/tag/2026.03 · Note
• https://twitter.com/the_yellow_fall/status/2042259740932108335 · Twitter Post
• https://twitter.com/CVEnew/status/2041282879632879683 · Twitter Post
• https://twitter.com/CveFindCom/status/2041285692152496543 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041283790283128865 · Twitter Post
• https://twitter.com/CyberEdition/status/2042497819844718920 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041381466618126823 · Twitter Post