CVE-2026-5708

OVERVIEW CVE-2026-5708 is a privilege escalation vulnerability affecting AWS Research and Engineering Studio (RES) versions prior to 2026.03. The flaw involves unsanitized control of user-modifiable attributes in the session creation component, which authenticated users can exploit through a crafted API request to escalate privileges and assume the virtual desktop host instance profile permissions, potentially granting unauthorized access to AWS resources and services. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and low privileges, but no user interaction. The impact is severe across all three dimensions: confidentiality, integrity, and availability are all rated as high. The EPSS score of 0.00045 indicates this vulnerability is in the lower percentile for exploit probability relative to all known CVEs, though the FAUCET Risk Score of 52.0/100 suggests moderate organizational risk. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild, and CVE-2026-5708 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability remains on the inactive Hot List status. AWS has released mitigation guidance recommending immediate upgrade to RES version 2026.03 or application of available mitigation patches to existing deployments.