Amazon WorkSpaces EUVD-2026-27149

Requires authenticated access to an Amazon WorkSpaces for Windows instance as a low-privileged local user (PR:L). The attacker must have the ability to execute code locally, create symbolic links or directory junctions (standard user capability on Windows), and time operations to coincide with the Skylight Workspace Config Service's log rotation events. No special Windows features need to be enabled-the vulnerability exists in default WorkSpaces configurations running versions before 2.6.2034.0. Exploitation is limited to local attack scenarios; remote network-based exploitation is not possible (AV:L). The local access requirement significantly constrains realistic threat scenarios to environments where untrusted users have WorkSpaces access, insider threats, or attackers who have already achieved initial compromise through phishing, stolen credentials, or supply chain attacks. Organizations that enforce strict local user privilege restrictions and disable local user code execution reduce exploitability, though the PR:L requirement means standard users without admin rights can still exploit this flaw.

Real-world risk is moderate despite the 8.5 CVSS score. The CVSS vector (AV:L/AC:L/PR:L) indicates local access with low-privilege authentication is required, significantly constraining the attack surface compared to network-exploitable vulnerabilities. Attack complexity is low once local access is achieved, and no user interaction is needed. Not present in CISA KEV, indicating no confirmed active exploitation in the wild. No public proof-of-concept exploit identified at time of analysis. EPSS data not provided but typically scores low for local-only vulnerabilities. From an SSVC perspective: exploitation status is none, automatable is no (requires local access), technical impact is total (SYSTEM access). This becomes a priority concern in multi-tenant VDI environments where WorkSpaces hosts untrusted users, or when combined with initial access vectors like phishing or supply chain compromise. For organizations with strong endpoint controls and minimal local user privileges, risk is lower. The vendor-confirmed fix in version 2.6.2034.0 provides clear remediation path.

An attacker with compromised low-privilege user credentials on an Amazon WorkSpaces Windows instance identifies the Skylight Workspace Config Service's log rotation schedule. During a log rotation operation, the attacker exploits the race condition by rapidly creating a symbolic link or directory junction that redirects the service's write operation from the intended log directory to a protected system location such as C:\Windows\System32. The service, running with SYSTEM privileges, writes attacker-controlled content (disguised as log data) to the redirected location, bypassing file system permissions. The attacker places a malicious DLL or executable in a system directory, then triggers its execution through DLL hijacking or scheduled task manipulation, achieving full SYSTEM-level control over the WorkSpaces instance.