Amazon WorkSpaces for Windows contains a flaw in the Skylight Workspace Config Service log rotation mechanism. The service does not correctly enforce privilege boundaries, allowing a logged‑in non‑administrator user to write files to any location. This bypasses file system permission checks and gives the local user SYSTEM level access. The weakness is a classic example of improper privilege management, identified as CWE‑367.

The vulnerability applies to all Amazon WorkSpaces for Windows instances whose Skylight Workspace Config Service version is earlier than 2.6.2034.0. No other versions or operating systems are affected according to the CNA information.

With a CVSS score of 8.5 the flaw is considered high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector is local: an authenticated non‑admin user must already have access to the workstation and sufficient rights to invoke the log rotation service. Once the arbitrary file write is performed, the user can place an elevated‑privilege program or script and execute it to gain SYSTEM rights.