A critical OS command injection vulnerability in AWS Research and Engineering Studio (RES) enables remote authenticated attackers to execute arbitrary system commands, posing a severe risk to infrastructure integrity.

This is an OS command injection flaw (CWE-78) occurring within the FileBrowser API, triggered by unsanitized input. An authenticated user can leverage this to execute arbitrary commands on the underlying cluster-manager EC2 instance.

The ability for an authenticated actor to execute arbitrary commands on the cluster-manager node represents a total compromise of the affected instance. This could lead to unauthorized data access, lateral movement within the AWS environment, and complete disruption of research workflows. With a CVSS score of 8.8, this high-severity vulnerability requires immediate attention to prevent potential service takeover.

Immediate Action: Upgrade to RES version 2026.03 or apply the official security patch provided by AWS to sanitize input in the FileBrowser API.

Proactive Monitoring: Review access logs for the FileBrowser API to identify any unusual or malformed input strings that deviate from standard operational patterns.

Compensating Controls: Implement strict network access control lists (ACLs) and IAM policies to limit access to the RES management interface to only authorized personnel, thereby reducing the attack surface.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for full system compromise, administrators should prioritize the deployment of the 2026.03 update. If an immediate upgrade is not feasible, restrict access to the affected RES instance until the patch is applied to mitigate the risk of exploitation by malicious actors.