benzamir/cve-2026-7791Local Privilege Escalation in Amazon WorkSpaces via TOCTOU and Arbitrary File Write
Research proof-of-concept for local privilege escalation in Amazon WorkSpaces (TOCTOU + SYSTEM-level arbitrary file write in the Skylight Workspace Config Service).
Full technical details: Cymulate blog
| CVE | CVE-2026-7791 |
| Vendor | AWS Security Bulletin 2026-025-AWS |
| Patched in | Skylight 2.6.2034.0 |
| Author | Ben Zamir, Cymulate Research Labs |
MIT
Low-privileged WorkSpaces user can abuse the Skylight Workspace Config Service (running as SYSTEM) during scheduled log rotation: permissive ACLs under C:\ProgramData\Amazon, a ROTATE directory junction, no file-type checks, and a ~1–10 ms TOCTOU between the first File Move and enumeration of archived files.
Lab only. Vulnerable Skylight (before 2.6.2034.0), standard user, payload beside the executable.
1. Compile the code
2. Execute: poc.exe AutoPilot.dll "C:\Program Files\Amazon\cfn-bootstrap"
poc.exe <filename> [target path]
Keep the process running until rotation occurs.
Authorized security research and defensive testing on systems you own or are permitted to assess.