{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/workspaces-skylight--2.6.2034.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:amazon:workspaces_skylight:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-7791"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WorkSpaces Skylight (\u003c 2.6.2034.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","windows","windows-service","aws"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eCVE-2026-7791 is a local privilege escalation vulnerability affecting the Amazon WorkSpaces Skylight Workspace Config Service. The flaw exists in the log rotation mechanism, where a Time-of-Check Time-of-Use (TOCTOU) race condition can be triggered by a low-privileged user. By leveraging directory junctions within 'C:\\ProgramData\\Amazon', an attacker can manipulate file operations conducted by the service, which runs with SYSTEM privileges, to perform an arbitrary file write. AWS has addressed this vulnerability in version 2.6.2034.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker with standard user privileges identifies the directory structure used by the Skylight Workspace Config Service under 'C:\\ProgramData\\Amazon'.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a directory junction (e.g., a 'ROTATE' junction) to intercept log rotation file operations.\u003c/li\u003e\n\u003cli\u003eThe attacker deploys a malicious payload in a location accessible to the service.\u003c/li\u003e\n\u003cli\u003eThe attacker waits for the scheduled log rotation process initiated by the service.\u003c/li\u003e\n\u003cli\u003eThe attacker exploits the TOCTOU race condition during the 1-10 ms window between the service performing the file move and the enumeration of archived files.\u003c/li\u003e\n\u003cli\u003eThe service, operating as SYSTEM, inadvertently writes the attacker-controlled content or moves a malicious file to a privileged location.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the payload to gain elevated privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user to gain SYSTEM-level execution on the affected host, facilitating full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Amazon WorkSpaces Skylight installations to version 2.6.2034.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing directory junctions and file permissions within 'C:\\ProgramData\\Amazon' for unauthorized modifications.\u003c/li\u003e\n\u003cli\u003eReview process-creation logs for execution of binaries originating from suspicious directories or unexpected command-line arguments involving 'cfn-bootstrap' or similar service-related paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T07:02:42Z","date_published":"2026-10-22T07:02:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-7791/","summary":"A local privilege escalation vulnerability in the Amazon WorkSpaces Skylight Workspace Config Service allows low-privileged users to achieve arbitrary file writes as SYSTEM via a TOCTOU race condition during log rotation.","title":"Amazon WorkSpaces Skylight: Local privilege escalation (CVE-2026-7791)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-7791/"}],"language":"en","title":"CraftedSignal Threat Feed - WorkSpaces Skylight (\u003c 2.6.2034.0)","version":"https://jsonfeed.org/version/1.1"}