PT-2026-30747 · Amazon Web Services · Research/Engineering Studio

Julianallenderussek · Published 2026-04-06 · Updated 2026-04-07 · CVE-2026-5709

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01

Description Improper input validation in the FileBrowser API within AWS Research and Engineering Studio (RES) could allow a remote authenticated attacker to execute arbitrary commands on the cluster-manager EC2 instance. This is possible through crafted input when utilizing the FileBrowser functionality.

Recommendations Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-5709

Affected Products

Research/Engineering Studio

References · 6

• 🔥 https://github.com/aws/res/issues/150 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5709 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-014-aws · Vendor Advisory
• https://github.com/aws/res/releases/tag/2026.03 · Note
• https://twitter.com/VulmonFeeds/status/2041378906247237984 · Twitter Post
• https://twitter.com/CVEnew/status/2041282874687807692 · Twitter Post