CVE-2026-7791 Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent
A local non-admin user can escalate privileges to SYSTEM by exploiting improper privilege management in the log rotation mechanism of Amazon WorkSpaces for Windows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7791?
CVE-2026-7791 is a high-severity vulnerability in Amazon Workspaces, published on 4 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file system permission protections, leading to local privilege escalation to SYSTEM.
Weakness: CWE-367
Which versions are affected by CVE-2026-7791?
How do I fix CVE-2026-7791?
No fix has been published for CVE-2026-7791 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-7791 being exploited?
There is no known exploitation of CVE-2026-7791 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rp3m-v2vr-fvq8.