---
id: CVE-2026-5708
title: >-
  Unsanitized control of user-modifiable attributes in the session creation
  component in AWS Research and Engineering Studio (RES) prior to version
  2026.03 could allow an authenticated remote user to escalate privileges,
  assume the virtual…
summary: >-
  Unsanitized control of user-modifiable attributes in the session creation
  component in AWS Research and Engineering Studio (RES) prior to version
  2026.03 could allow an authenticated remote user to escalate privileges,
  assume the virtual…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-915
vendor: amazon
product: research_and_engineering_studio
affected:
  - research_and_engineering_studio < 2026.03
patched:
  - research_and_engineering_studio 2026.03
published: '2026-04-06'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5708'
references:
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-014-aws/'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: 'https://github.com/aws/res/issues/149'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: 'https://github.com/aws/res/releases/tag/2026.03'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
tags:
  - nvd
epss: 0.00841
epssPercentile: 0.56385
ingestedAt: '2026-07-24T09:23:52.525Z'
---

## Overview

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with AWS resources and services via a crafted API request.

To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

## Affected

- `research_and_engineering_studio < 2026.03`

## Remediation

Upgrade past the affected range:

- `research_and_engineering_studio 2026.03`