Vulnerability in Amazon Research And Engineering Studio
CVE-2026-5708
Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
Vulnerability class: Mass Assignment
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (53.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.007 · change: -0.001
Affected products
Weakness classification (CWE)
References
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, Release Notes)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Exploit, Mitigation, patch, Issue Tracking)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-5708?
- CVE-2026-5708 is a high-severity vulnerability in Amazon Research And Engineering Studio, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 8.8/10. Published 2026-04-06.
- How severe is CVE-2026-5708?
- High severity. CVSS v3 base score is 8.8 out of 10.