Amazon WorkSpaces Skylight: Local privilege escalation (CVE-2026-7791)

CVE-2026-7791 is a local privilege escalation vulnerability affecting the Amazon WorkSpaces Skylight Workspace Config Service. The flaw exists in the log rotation mechanism, where a Time-of-Check Time-of-Use (TOCTOU) race condition can be triggered by a low-privileged user. By leveraging directory junctions within 'C:\ProgramData\Amazon', an attacker can manipulate file operations conducted by the service, which runs with SYSTEM privileges, to perform an arbitrary file write. AWS has addressed this vulnerability in version 2.6.2034.0.

Attack Chain

1. An attacker with standard user privileges identifies the directory structure used by the Skylight Workspace Config Service under 'C:\ProgramData\Amazon'.
2. The attacker creates a directory junction (e.g., a 'ROTATE' junction) to intercept log rotation file operations.
3. The attacker deploys a malicious payload in a location accessible to the service.
4. The attacker waits for the scheduled log rotation process initiated by the service.
5. The attacker exploits the TOCTOU race condition during the 1-10 ms window between the service performing the file move and the enumeration of archived files.
6. The service, operating as SYSTEM, inadvertently writes the attacker-controlled content or moves a malicious file to a privileged location.
7. The attacker executes the payload to gain elevated privileges.

Impact

Successful exploitation allows a low-privileged user to gain SYSTEM-level execution on the affected host, facilitating full system compromise.

Recommendation

• Patch all Amazon WorkSpaces Skylight installations to version 2.6.2034.0 or later immediately.
• Audit existing directory junctions and file permissions within 'C:\ProgramData\Amazon' for unauthorized modifications.
• Review process-creation logs for execution of binaries originating from suspicious directories or unexpected command-line arguments involving 'cfn-bootstrap' or similar service-related paths.