CVE-2026-7791High· 7.8▾ MidnightPoC available

Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary l…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 4, 2026

Updated

Oct 20, 2026

CVSS

7.8

Vendor

Amazon

Product

Workspaces

CWE

CWE-367

Depth score

55 · Moderate

EPSS

0.13% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-20

GitHub PoCs

1 public repository

BenZamir/CVE-2026-7791 ↗

CISA SSVC

decided 2026-05-05

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 170 days

May 4, 2026Published
Disclosed via CVEORG
Oct 20, 2026Record revised
Last analysed / modified upstream
Oct 20, 2026EPSS first tracked
0.1%
Oct 20, 2026Public exploit observed
1 GitHub repo (last check)

Amazon CWE-367 #cve.org #exploit-available

Affected

Workspaces < 2.6.2034.0

Full technical detail▾

Overview

Affected

Workspaces < 2.6.2034.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

https://aws.amazon.com/security/security-bulletins/2026-025-aws/

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available

← Back to feed

CVE-2026-7791High· 7.8▾ MidnightPoC available

Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 4, 2026

Updated

Oct 20, 2026

CVSS

7.8

Vendor

Amazon

Product

Workspaces

CWE

CWE-367

Depth score

55 · Moderate

EPSS

0.13% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-20

GitHub PoCs

1 public repository

BenZamir/CVE-2026-7791 ↗

CISA SSVC

decided 2026-05-05

Exploitation: none
Automatable: no
Technical impact: total

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 170 days

May 4, 2026Published
Disclosed via CVEORG
Oct 20, 2026Record revised
Last analysed / modified upstream
Oct 20, 2026EPSS first tracked
0.1%
Oct 20, 2026Public exploit observed
1 GitHub repo (last check)

Amazon CWE-367 #cve.org #exploit-available

Affected

Workspaces < 2.6.2034.0

Full technical detail▾

Overview

Affected

Workspaces < 2.6.2034.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

https://aws.amazon.com/security/security-bulletins/2026-025-aws/

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available