The vulnerability involves hardcoded AWS credentials and other secret material embedded in the Worksnaps client application binaries. Those credentials grant AWS root identity access to the organization’s production cloud resources. An attacker who obtains the affected binaries can extract the keys and use them to read or modify sensitive data stored in S3 buckets, including screenshots of user desktops. The result is a loss of confidentiality and possible control of the entire cloud environment.

Silver Leaf Technologies, Inc. Worksnaps client application versions earlier than 1.6.20260201 are affected. The exposure pertains to the client binaries distributed to customers, and does not affect newer releases.

The CVSS score of 9.3 reflects a severe exploitability, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely gain access by obtaining the compromised binaries through normal distribution channels or by compromising a system that holds the binaries. Once a binary is accessed, credential extraction is straightforward and can immediately authorize full cloud resource access.