Is CVE-2026-5708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5708 being exploited in the wild.

How severe is CVE-2026-5708?

High severity, with a CVSS score of 8.8, published 6 April 2026.

Which products and versions are affected?

Amazon Web Services Research and Engineering Studio 2023.11 through 2025.12.01.

Is there a fix for CVE-2026-5708?

A patch was published on 2026-03-26: Version 2026.03 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5708 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-5708?

Check whether you run Amazon Engineering Studio, Amazon Research or Amazon Web Services Research and Engineering Studio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5708: AWS Research and Engineering Studio privilege escalation in session creation

CVE-2026-5708 · Severity: high · CVSS 8.8 · Published 2026-04-06

AWS Research and Engineering Studio (RES) is a web portal used by administrators to manage secure cloud-based research environments. A security flaw in the session creation tool allows an authorized user to gain higher-level permissions than intended. By exploiting this, an attacker could take control of the virtual desktop's identity to access other sensitive AWS resources and services within the organization's cloud environment.

Technologies: Amazon Engineering Studio, Amazon Research, Amazon Web Services Research and Engineering Studio. Vendors: Amazon, Amazon Web Services.

Quick answers

Is CVE-2026-5708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5708 being exploited in the wild.
How severe is CVE-2026-5708?: High severity, with a CVSS score of 8.8, published 6 April 2026.
Which products and versions are affected?: Amazon Web Services Research and Engineering Studio 2023.11 through 2025.12.01.
Is there a fix for CVE-2026-5708?: A patch was published on 2026-03-26: Version 2026.03 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5708 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5708?: Check whether you run Amazon Engineering Studio, Amazon Research or Amazon Web Services Research and Engineering Studio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability (CWE-915) exists in the session creation component of AWS Research and Engineering Studio (RES). The root cause is the lack of sanitization for user-modifiable attributes, specifically allowing users to provide an external 'instance_profile_arn' when calling the CreateSession API. An authenticated remote attacker can exploit this by sending a crafted API request to replace the default instance profile with one of their choosing. This allows the attacker to assume the permissions of the injected instance profile, potentially gaining unauthorized access to broader AWS resources and services. The issue is resolved in RES version 2026.03, and manual patches are available for older versions.

Affected products

AWS Research and Engineering Studio (RES) 2023.11 through 2025.12.01

Timeline

2026-03-10: disclosed: Issue opened on GitHub repository
2026-03-26: patched: Version 2026.03 released with security fixes
2026-04-06: advisory: AWS security bulletin and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.