CVE-2026-5707

HighPublic PoCRCE

Published: 06 April 2026

Published

06 April 2026

Modified

10 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0012 31.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5707 is a high-severity OS Command Injection (CWE-78) vulnerability in Amazon Research And Engineering Studio. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 31.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation of unsanitized inputs such as virtual desktop session names to prevent OS command injection attacks.

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and correction of flaws like this command injection vulnerability through timely patching or upgrades.

SI-9 Information Input Restrictions partial match

prevent

Enforces restrictions on information inputs like session names to limit the scope for crafting malicious payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Command injection vulnerability allows remote low-privileged attackers to execute arbitrary OS commands as root, directly enabling exploitation of remote services (T1210), exploitation for privilege escalation (T1068), and command and scripting interpreter execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop…

host via a crafted session name. To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

Deeper analysisAI

CVE-2026-5707 is a command injection vulnerability stemming from unsanitized input in an OS command used for virtual desktop session name handling in AWS Research and Engineering Studio (RES). The issue affects RES versions 2025.03 through 2025.12.01, where insufficient input validation allows malicious payloads to be injected into system commands executed on the virtual desktop host. Classified under CWE-78 (OS Command Injection), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for root-level compromise.

A remote authenticated attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). By crafting a malicious session name, the attacker injects and executes arbitrary OS commands as root on the virtual desktop host, achieving high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged scope (S:U).

AWS advisories recommend upgrading to RES version 2026.03 or applying the corresponding mitigation patch to existing environments. Detailed guidance is available in the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-014-aws/, the related GitHub issue at https://github.com/aws/res/issues/151, and the release notes for version 2026.03 at https://github.com/aws/res/releases/tag/2026.03.