CVE-2026-5708

HighCVSS 8.8/10Last modified Jul 24, 2026

Description

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request.

To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-915

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-570807.5Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wiCVE-2026-570817.5Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per CVE-2026-570825.9Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message CVE-2026-570835.5Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.CVE-2026-570845.5Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.CVE-2026-570853.3Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.CVE-2026-570877.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.CVE-2026-570887.8Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.CVE-2026-570899.8Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.CVE-2026-57098.8Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remotCVE-2026-570909.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.CVE-2026-570917.8Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.