CVE-2026-5709

HighCVSS 8.8/10Last modified Jul 24, 2026

Description

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality.

To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-570909.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.CVE-2026-570917.8Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.CVE-2026-570929.9Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.CVE-2026-570937.8Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-570948.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.CVE-2026-570957.8Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally.CVE-2026-570967.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.CVE-2026-570976.8Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2026-570987.5Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a networCVE-2026-570997.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-57107.5The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File ReaCVE-2026-571008.8Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges