Is CVE-2026-5709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5709 being exploited in the wild.

How severe is CVE-2026-5709?

High severity, with a CVSS score of 8.8, published 6 April 2026.

Which products and versions are affected?

AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01.

Is there a fix for CVE-2026-5709?

A patch was published on 2026-03-26: RES version 2026.03 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5709 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-5709?

Check whether you run Amazon Engineering Studio or Amazon Research. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5709: AWS Research and Engineering Studio command injection in FileBrowser API

CVE-2026-5709 · Severity: high · CVSS 8.8 · Published 2026-04-06

AWS Research and Engineering Studio (RES), a portal used by administrators to manage cloud-based research environments, contains a security flaw in its file browsing interface. An authorized user could exploit this vulnerability to run unauthorized commands on the central management server. This could lead to a full system takeover, potentially compromising research data, disrupting operations, or allowing further access into the cloud environment.

Technologies: Amazon Engineering Studio, Amazon Research. Vendors: Amazon.

Quick answers

Is CVE-2026-5709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5709 being exploited in the wild.
How severe is CVE-2026-5709?: High severity, with a CVSS score of 8.8, published 6 April 2026.
Which products and versions are affected?: AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01.
Is there a fix for CVE-2026-5709?: A patch was published on 2026-03-26: RES version 2026.03 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5709 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5709?: Check whether you run Amazon Engineering Studio or Amazon Research. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the FileBrowser List Files API of AWS Research and Engineering Studio (RES). The root cause is the failure to sanitize file path parameters, which allows shell meta-characters to be processed by the underlying operating system. An authenticated remote attacker can exploit this by sending crafted input to the FileBrowser functionality to execute arbitrary commands on the cluster-manager EC2 instance. The vulnerability affects versions 2024.10 through 2025.12.01 and is resolved in version 2026.03. Mitigation patches are also available for existing environments.

Affected products

AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01

Timeline

2026-03-10: disclosed: Issue reported on GitHub
2026-03-26: patched: RES version 2026.03 released
2026-04-06: advisory: AWS security bulletin published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.