Vulnerability in AWS Research And Engineering Studio (Res)
CVE-2025-12815
An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate this issue, users should upgrade to version 2025.09 or above.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- AWS Research And Engineering Studio (Res) — versions 2025.09
Weakness classification (CWE)
References
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-12815?
- CVE-2025-12815 is a medium-severity vulnerability in AWS Research And Engineering Studio (Res), classified under CWE-283. CVSS score: 4.3/10. Published 2025-11-06.
- How severe is CVE-2025-12815?
- Medium severity. CVSS v3 base score is 4.3 out of 10.