AWS patches flaws in research portal

Amazon Web Services has patched three high-severity vulnerabilities in its open-source Research and Engineering Studio platform, closing weaknesses that could have allowed authenticated users to run commands on key systems or gain broader permissions inside cloud environments used for scientific and engineering work.

The flaws affected AWS Research and Engineering Studio, known as RES, a web-based portal that helps administrators build and manage controlled research and engineering environments on AWS. In a security bulletin published on 6 April, AWS said the issues were fixed in RES version 2026.03 and urged customers running version 2025.12.01 or earlier to upgrade or apply mitigation patches to existing deployments.

Two of the vulnerabilities carried remote code execution risk. One, tracked as CVE-2026-5707, stemmed from unsanitised input in the handling of virtual desktop session names. AWS said an authenticated remote actor could use a crafted session name to execute arbitrary commands as root on a virtual desktop host. Another, CVE-2026-5709, involved unsanitised input in the FileBrowser API and could allow arbitrary commands to run on the cluster-manager EC2 instance when the file browsing function was used.

A third flaw, CVE-2026-5708, was described as a privilege-escalation issue in the session creation component. According to AWS, an authenticated user could manipulate session attributes, assume the virtual desktop host instance profile permissions and interact with AWS resources and services beyond the intended scope. That raised concern because instance profiles can define what connected compute resources are allowed to do across an AWS environment.

AWS classified the bulletin as “Important”, while vulnerability databases and advisories associated with the disclosures indicated high severity for the exposed attack paths. The affected versions differed slightly across the three flaws. AWS said CVE-2026-5707 applied to RES versions from 2025.03 through 2025.12.01, CVE-2026-5709 to versions from 2024.10 through 2025.12.01, and CVE-2026-5708 to versions before 2026.03.

Release notes for RES version 2026.03 show that AWS addressed what it described as a privilege-escalation vulnerability in the FileBrowser component, a cross-user remote code execution issue through session name injection, and an issue allowing an external instance profile ARN to be used during session creation. That language aligns with the three published CVEs and suggests AWS bundled the fixes into a broader March 2026 product update rather than issuing a standalone emergency release.

Research and Engineering Studio is not among AWS’s most widely known products, but it plays an important role in sectors where controlled virtual workspaces matter, including research computing, engineering simulation, product design and data analysis. AWS has promoted the service in public-sector and digital-engineering settings as a way to let users enter secure Linux and Windows desktop environments through a browser-based portal while keeping central administrative control over infrastructure and access policies.

That operating model helps explain why the flaws draw attention beyond the software itself. A weakness on a virtual desktop host or cluster-management layer can become more significant when those systems sit close to data pipelines, storage, compute clusters and other shared services. Even where exploitation requires authentication, the combination of code execution and privilege expansion can increase the risk of lateral movement or misuse of attached cloud permissions.

AWS did not say in the bulletin that the flaws had been exploited in the wild, nor did the primary advisory point to public proof-of-concept code. The company instead focused on remediation, telling customers to move to version 2026.03 and warning users of forked or derivative codebases to ensure those copies also incorporated the fixes. That point matters because RES is open source, and organisations that customised the platform may need to do more than apply a standard managed-service update.

AWS also published mitigation guidance for customers unable to upgrade immediately. A GitHub issue tied to the privilege-escalation flaw says the recommended option is to upgrade to version 2026.03 or newer, while an alternative is to patch existing environments. The mitigation material indicates the patch path applies to older RES deployments and requires supporting tools including AWS CLI v2, Python 3.9.16 or above and Boto3.

For enterprise security teams, the episode is another reminder that specialist cloud portals can create concentrated risk even when they are built for controlled environments. Platforms designed to simplify access to secure research and engineering workspaces often sit at the junction of identity, storage, virtual desktops and orchestration. A defect in input handling or permission enforcement in such systems can have effects well beyond a single user session.

Customers using RES will now be weighing whether they run unmodified builds, maintain internal forks or depend on bespoke integrations that could complicate patching. Security teams are also likely to review session-creation controls, audit instance-profile permissions attached to virtual desktops and examine whether file-management features expose administrative components more broadly than intended.