CVE-2026-5707
High
Description
Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
SeverityHigh
CVSS8.8
Exploit probability—
ProductAmazon Research And Engineering Studio
PublishedApr 6, 2026
First seenApr 6, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- amazon research_and_engineering_studio2026.03 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amazon research_and_engineering_studio | v < 2026.03 | 2026.03 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.