PT-2026-30746 · Amazon Web Services · Research/Engineering Studio

Julianallenderussek · CVE-2026-5708 · Published 2026-04-06 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Research and Engineering Studio (RES) versions prior to 2026.03

Description An issue exists in the session creation component of AWS Research and Engineering Studio (RES) where unsanitized control of user-modifiable attributes could allow an authenticated remote user to escalate privileges. Successful exploitation could allow an attacker to assume the virtual desktop host instance profile permissions and interact with AWS resources and services via a crafted API request.

Recommendations Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

Exploit

Fix

LPE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-5708

Affected Products

Research/Engineering Studio

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5708.json · Exploit
• 🔥 https://github.com/aws/res/issues/149 · Exploit
• https://osv.dev/vulnerability/CVE-2026-5708 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/2026-014-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5708 · Security Note
• https://github.com/aws/res/releases/tag/2026.03 · Note
• https://twitter.com/CveFindCom/status/2041285725711151565 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041283778849440232 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041384027236499720 · Twitter Post
• https://twitter.com/CVEnew/status/2041282878613713161 · Twitter Post