Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow a…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 6, 2026 · NIST NVD

   Detected

   Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to u

2. Jul 24, 2026 · NIST NVD

   Updated

   Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request. To remediate this issue, users are advised to u

Affected

• cpe amazon/research and engineering studioversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-5708

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-5708

  Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions,

  nvd.nist.gov

References

• Vendor Advisory · aws.amazon.com
• Exploit · github.com
• Release Notes · github.com