An authenticated remote attacker can exploit a flaw in AWS Research and Engineering Studio to gain unauthorized access to host instance permissions and AWS service resources.

The application fails to sanitize user-modifiable attributes during session creation, which is classified as CWE-915 (Improperly controlled modification of Dynamically-Determined object attributes). This allows an authenticated user to perform privilege escalation and assume the identity of the virtual desktop host instance profile.

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the cloud environment. By assuming the host instance profile permissions, an attacker can move laterally within the AWS infrastructure, potentially accessing sensitive data or disrupting critical research workflows. Given the CVSS score of 8.8, this vulnerability is considered High severity and demands immediate attention to prevent unauthorized cloud resource manipulation.

Immediate Action: Upgrade the AWS Research and Engineering Studio (RES) environment to version 2026.03 or apply the vendor-provided patch as detailed in the official AWS security bulletin.

Proactive Monitoring: Audit AWS CloudTrail logs for unusual API calls originating from RES sessions, specifically looking for unauthorized attempts to assume or modify IAM roles and instance profiles.

Compensating Controls: Implement strict IAM policies that adhere to the principle of least privilege for the RES instance profiles, limiting the potential impact if a session is compromised.

Public Exploit Available: Unknown

Due to the potential for full privilege escalation within the AWS environment, administrators should prioritize this update. Ensure that all affected RES deployments are patched to version 2026.03 immediately to neutralize the risk of unauthorized resource interaction.