AWS EUVD-2026-19550

Requires authenticated access to AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. Attacker must be a remote authenticated user with access to the FileBrowser API functionality. No victim interaction needed. Exploits unsanitized input handling in FileBrowser to execute arbitrary commands on cluster-manager EC2 instance.

Real-world risk is moderate-to-high for organizations running affected RES versions. The CVSS 7.7 score reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) combined with network accessibility and low attack complexity. However, meaningful exploitation requires authenticated access (PR:L) and some attack preparation (AT:P indicates attack prerequisites must be met). No EPSS data is provided, and no public exploit code exists at time of analysis, reducing immediate weaponization risk. The vulnerability is NOT confirmed actively exploited (no CISA KEV listing). From an SSVC perspective: exploitation status is none-known, automatable potential is high given the command injection class and network vector, technical impact is total (arbitrary code execution on critical infrastructure component). Priority should be high for organizations exposing RES to authenticated internal users or contractors, particularly in multi-tenant research environments where lateral movement to cluster-manager instances could compromise entire HPC workloads. The availability of an official patch and clear vendor advisory reduces residual risk for organizations maintaining current patch cycles.

An authenticated researcher with standard RES access crafts malicious input through the FileBrowser API interface, embedding command separators or injection sequences that exploit the unsanitized input handling. When the FileBrowser processes this input to perform file operations on the cluster-manager EC2 instance, the injected commands execute with the privileges of the RES service account. The attacker achieves arbitrary code execution on the cluster-manager, potentially pivoting to access sensitive research data, modify HPC job submissions, or establish persistence within the research infrastructure. Given the low attack complexity (AC:L) and network attack vector (AV:N), remote exploitation requires only valid credentials and knowledge of the FileBrowser API endpoints.