// Security Advisory Triage
AWS withdrew security bulletin 2026-014 covering three RCE vulnerabilities in RES
AWS security bulletins · published 2026-09-24 19:12 UTC
CORRECTED 2026-09-24 22:33 UTC — Correction: AWS did not withdraw this bulletin. The bulletin page is still live and lists the same CVEs. AWS's feed stopped including the bulletin text on 24 Sep, and RADAR misread that as a removal. The rule that caused this is fixed.
Stood 3h 21m · cause source changed format · every correction ↗
WHAT CHANGEDAWS Security Bulletin 2026-014, published 6 April 2026, was removed from the feed on 24 September 2026. The bulletin documented CVE-2026-5707, CVE-2026-5708, and CVE-2026-5709 affecting Research and Engineering Studio (RES) versions through 2025.12.01. All three allowed remote code execution or privilege escalation: command injection via session names (CVE-5707), privilege escalation to instance profile permissions (CVE-5708), and command execution via FileBrowser API (CVE-5709). The entire advisory text, affected version ranges, and remediation guidance have been deleted.
WHY IT MATTERSIf you are running RES <= 2025.12.01, you no longer have an authoritative source documenting these vulnerabilities or how to fix them. The CVEs describe root-level command execution and AWS credential escalation paths that remain exploitable regardless of whether AWS has published guidance. Withdrawn advisories typically indicate either a retraction (the vulnerabilities were misreported) or a superseding update, but without replacement content you cannot distinguish between the two.
WHAT TO DOCheck the RES GitHub repository (aws/res) for issues or commits referencing CVE-2026-5707, CVE-2026-5708, or CVE-2026-5709 to determine whether patches were released and whether the withdrawal indicates a fix or a retraction. If you are running RES 2025.12.01 or earlier and find no clear retraction, treat the three CVEs as valid and either upgrade to a version past 2026.03 or disable virtual desktop session creation and FileBrowser functionality until you have confirmation.
Model-reported confidence 85% (not measured accuracy)
Primary source ↗
written by anthropic/claude-sonnet-4.5
Show the reasoning — raw diff, triage verdict, confidence
RAW DIFF
## Issues with AWS Research and Engineering Studio (RES) https://aws.amazon.com/security/security-bulletins/rss/2026-014-aws/ -Wed, 09 Sep 2026 21:30:11 +0000 - -Bulletin ID: 2026-014-AWS - -Scope: AWS - -Content Type: Important (requires attention) - -Publication Date: 2026/04/06 14:00 PM PDT -Description: -Research and Engineering Studio (RES) on AWS is an open source, web portal design for administrators to create and manage secure cloud-based research and engineering environments. We have identified the following issues with the AWS Research and Engineering Studio (RES). -CVE-2026-5707: Unsanitized input in an OS Command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name. -CVE-2026-5708: Improper control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) before version 2026.03 might allow an authenticated remote user to escalate privileges and assume the Virtual Desktop Host instance profile permissions and interact with other AWS resources and services via a crafted API request. -CVE-2026-5709: Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio (RES) version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. -Impacted versions: <= 2025.12.01 -Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. +Thu, 24 Sep 2026 17:49:07 +0000
HOW IT WAS JUDGED
Triage signals below are model-reported assertions, preserved verbatim; they are not independent arithmetic verification.
| triage verdict | MATERIAL at 0.92, needed 0.55 |
|---|---|
| triage reasoning | Critical security advisory content removed. Teams cannot assess or act on RES vulnerabilities. |
| signals | advisory content removed entirely · three CVEs with RCE and privilege escalation deleted · affected versions and remediation guidance removed · security bulletin depublished or gutted |
| suppression | — |
| triage model | anthropic/claude-haiku-4.5 ($0.00000) |
| writer model | anthropic/claude-sonnet-4.5 ($0.00000) |