CVE-2026-5707 - Vulnerability Analysis

Overview

AWS Research and Engineering Studio (RES) 2025.03 through 2025.12.01 contains a command injection caused by unsanitized input in virtual desktop session name handling, letting remote authenticated actors execute arbitrary commands as root, exploit requires authentication.

Severity & Score

Impact

Remote authenticated actors can execute arbitrary commands as root, leading to full system compromise.

Mitigation

Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

References

• https://github.com/aws/res/releases/tag/2026.03
• https://aws.amazon.com/security/security-bulletins/2026-014-aws/
• https://github.com/aws/res/issues/151

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner