CVE-2026-5709 - Vulnerability Analysis

Overview

AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01 contains a command injection caused by unsanitized input in the FileBrowser API, letting remote authenticated actors execute arbitrary commands on the cluster-manager EC2 instance, exploit requires authentication.

Severity & Score

Impact

Remote authenticated actors can execute arbitrary commands on the cluster-manager EC2 instance, potentially leading to full system compromise.

Mitigation

Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

References

• https://aws.amazon.com/security/security-bulletins/2026-014-aws/
• https://github.com/aws/res/issues/150
• https://github.com/aws/res/releases/tag/2026.03

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner