CVE-2026-5709highCWE-78

CVE-2026-5709: falha de alta gravidade em AWS Research and Engineering Studio (RES)

AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Research and Engineering Studio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 1.1%
Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
AWS · Research and Engineering Studio (RES)
CVEs relacionadas — AWS Research and Engineering Studio (RES)

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5707HIGHCommand Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES)EPSS 1.0%CVE-2026-5708HIGHImproper Control of User-Modifiable Attributes in RES CreateSession APIEPSS 0.9%CVE-2025-12815MEDIUMCVE-2025-12815EPSS 0.3%