Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-5709: AWS RES FileBrowser lets attacker run commands

CVE-2026-5709 · published 7 months ago

Summary

The FileBrowser feature in AWS Research and Engineering Studio versions from late 2024 through early 2025 accepts input without checking it, allowing a signed‑in user to cause the underlying server to run any command they choose. This could let an attacker take control of the machine that manages the compute cluster. Update to the 2026.03 release or apply the provided patch to stop the risk.

Original advisory text

AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality.

To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.

References

https://github.com/aws/res/issues/150 Patch
https://aws.amazon.com/security/security-bulletins/2026-014-aws/ Vendor Advisory
https://github.com/aws/res/releases/tag/2026.03 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5709.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5709 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published6 Apr 2026

Updated3 Nov 2026

First seen6 Apr 2026

Sources

CVE-2026-5709 · NVD

CVE-2026-5709 · OSV

Track software like this

Free during beta