{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/virtual-engineering-workbench/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:amazon:virtual_engineering_workbench:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-119085"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Virtual Engineering Workbench"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cloud-security","code-execution"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAmazon Virtual Engineering Workbench (VEW) contains a vulnerability (CVE-2026-119085) in the template engine used within its publishing component. The flaw allows a remote authenticated user to supply a crafted CloudFormation template body containing malicious template engine directives through the product versioning API. Successful exploitation results in arbitrary code execution with the permissions of the publishing Lambda function's IAM role, potentially enabling unauthorized access to data and resources across all tenant projects.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the AWS Lambda IAM role associated with the publishing component. This may result in unauthorized access, modification, or exfiltration of sensitive data and resources across all tenant projects within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Amazon Virtual Engineering Workbench deployment immediately by redeploying from the latest version available in the awslabs/virtual-engineering-workbench repository.\u003c/li\u003e\n\u003cli\u003eReview IAM permissions associated with the publishing Lambda function to ensure the principle of least privilege is applied, limiting the impact of potential code execution.\u003c/li\u003e\n\u003cli\u003eAudit logs for the product versioning API for requests containing unusual CloudFormation template bodies or template engine directive patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T19:49:34Z","date_published":"2026-11-02T19:49:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-amazon-vew-rce/","summary":"An improper neutralization vulnerability in the Amazon Virtual Engineering Workbench publishing component allows authenticated remote attackers to execute arbitrary code via crafted CloudFormation templates.","title":"Amazon Virtual Engineering Workbench: Arbitrary code execution via template engine (CVE-2026-119085)","url":"https://feed.craftedsignal.io/briefs/2026-11-amazon-vew-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Virtual Engineering Workbench","version":"https://jsonfeed.org/version/1.1"}