CVE-2026-7791 - Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent

criticalCVE-2026-7791

Bulletin ID: 2026-025-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/05/04 15:30 PM PDT Description: Amazon Skylight Workspace Config Service ( slwsconfigservice) is a critical background service within Amazon WorkSpaces that manages system configuration, monitors health, and updates components. We identified CVE-2026-7791 which allows a local non-admin authenticated user to escalate privileges to SYSTEM by exploiting a race condition in the Skylight Workspace Config Service's log file archival process. Impacted versions: < 2.6.2034.0 of the Windows Amazon Skylight Workspace Config Service (slwsconfigservice) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Amazon product: Skylight Workspace Config Service Privilege escalationaffected: < 2.6.2034.0

What: A race condition allows a local non-admin user to escalate privileges to SYSTEM.
Who is affected: Local authenticated users of the Skylight Workspace Config Service on affected versions.
Urgency: Remediation is critical due to the potential for local privilege escalation.
Action: Update to version 2.6.2034.0 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Skylight Workspace Config Service

Get an email when a new Skylight Workspace Config Service advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: critical
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-025-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-77910.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-7791	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Local Privilege

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-7655: The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in…nvd · 2026-07-11
highCVE-2026-14262: The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulner…nvd · 2026-07-11
highCVE-2026-13756: The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions…nvd · 2026-07-11
criticalCVE-2026-20744: The charging station websocket endpoint accepts connections without proper authentication, whi…nvd · 2026-07-10
unknownCVE-2026-7639: Software installed and run as a non-privileged user may conduct a sequence of improper GPU syst…nvd · 2026-07-10
unknownCVE-2026-45196: Kernel software installed and running inside a Host VM may post improper commands to the GPU F…nvd · 2026-07-10