← Vulnerability feed

Vulnerability record · CVE-2026-5708 · published 6 April 2026

CVE-2026-5708: Amazon research and engineering studio mass assignment vulnerability

Amazon · Research And Engineering Studio

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

8.7 CVSS 4.0 High EPSS 0.75% · top 47.1% CWE-915 · Mass assignment
8.7CVSS 4.0 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
24 Jul 2026Last modified by NVD

Description

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://aws.amazon.com/security/security-bulletins/2026-014-aws/ Vendor Advisory
https://github.com/aws/res/issues/149 ExploitIssue TrackingMitigation
https://github.com/aws/res/releases/tag/2026.03 Release Notes

Track CVE-2026-5708 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-5707Amazon research and engineering studio os command injection vulnerabilityUnsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through …EPSS 0.99%7.7CVE-2026-5709Amazon research and engineering studio os command injection vulnerabilityUnsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authent…EPSS 0.99%

Source: NIST National Vulnerability Database (record CVE-2026-5708), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.