Unsanitized control of user‑modifiable attributes in the CreateSession API of AWS Research and Engineering Studio allows an authenticated user to supply crafted parameters that cause the system to grant the virtual desktop host instance profile permissions to that request. This results in privilege escalation, letting the attacker access AWS resources and services beyond the intended scope. The weakness is CWE‑915 and leads to unauthorized access to the host environment.

AWS Research and Engineering Studio instances running any version prior to 2026.03 are impacted. The vulnerability resides in the session creation component used by customers who deploy RES for virtual desktop management.

The base CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be an authenticated RES user, who can then craft a malicious API request to the CreateSession endpoint to elevate privileges.