← All Advisories

AWS Research and Engineering Studio FileBrowser API Passes Unsanitized Input to OS Commands, Allowing an Authenticated Remote User to Execute Arbitrary Code on the Cluster Manager

Last refreshed2026-09-30

Status: UPDATED  |  Advisory ID: CVE-2026-5709

Key Details

CVECVE-2026-5709
CVSS Score / Version8.8 (High) / CVSS v3.1
Updated2026-07-24
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsamazon research_and_engineering_studio
Classified asCWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
amazonresearch_and_engineering_studio
SubsystemsGeneral OT
SectorsMultiple

What to Know

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality.

To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment. (NVD)

What to Do

Monitor amazon's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-5709
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-5709
Vendor advisoryhttps://aws.amazon.com/security/security-bulletins/2026-014-aws/