Windows Users Below 2.6.2034.0 Must Reboot to Fix CVE-2026-7791 in Amazon WorkSpaces Skylight

A local privilege escalation flaw in Amazon WorkSpaces Skylight agent affects Windows users below version 2.6.2034.0, requiring a reboot to patch.

Threat Times Exposure DeskOctober 16, 20261 min read

Share LinkedIn Reddit

Illustration: A generic silver laptop rests on a desk, its screen displaying a blank blue window with a single white circular progress indicator spinning slowly in the center, sugg — AI-generated illustration: Threat Times

Key points

CVE-2026-7791 allows local non-admin users to escalate privileges to SYSTEM via a TOCTOU race condition.
The vulnerability exists in the Skylight Workspace Config Service log archival process on Windows WorkSpaces.
AWS released version 2.6.2034.0 to fix the issue, with users able to self-service the update by rebooting.

Amazon Web Services published a security bulletin on May 4, 2026, addressing a local privilege escalation vulnerability in its WorkSpaces service. The flaw, tracked as CVE-2026-7791, allows authenticated non-administrative users to gain SYSTEM-level privileges by exploiting a race condition in the Skylight Workspace Config Service.

The vulnerability stems from a Time-of-Check to Time-of-Use (TOCTOU) race condition within the service's log file archival process. According to the AWS advisory, this issue is rated as important and requires immediate attention. The flaw enables attackers to bypass standard permission restrictions and execute commands with higher system privileges.

Vulnerability Details and Context

The affected component is the Amazon Skylight Workspace Config Service, identified as slwsconfigservice. This background service manages system configuration, monitors health, and updates components within Amazon WorkSpaces. The race condition occurs specifically during the archival of log files, creating a window for exploitation.

AWS credited Cymulate for discovering the issue and collaborating through the coordinated vulnerability disclosure process. This marks another instance of third-party researchers identifying critical flaws in cloud infrastructure components, similar to recent disclosures in other platforms.

Affected Systems and Scope

The vulnerability impacts Amazon WorkSpaces customers using Windows WorkSpaces that have not opted into the "Local Administrator Setting" for their directory. Users who have enabled local administrator rights for their directory are not affected by this specific privilege escalation vector.

The flaw affects versions of the Skylight Workspace Config Service prior to 2.6.2034.0. Any Windows WorkSpace running an older version of this service is potentially vulnerable to local attackers seeking to elevate their access level.

What should you do?

AWS has released version 2.6.2034.0, which addresses CVE-2026-7791. Customers can apply this fix by rebooting their affected WorkSpaces, which triggers the self-service update mechanism. Administrators should verify that their instances have successfully updated to the patched version after rebooting.

Background: Coordinated vulnerability disclosure

Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.

Read the full guide: Coordinated Vulnerability Disclosure for Small Teams

What to do and how to stay safe: AWS

Reboot affected Windows WorkSpaces to trigger the automatic update to version 2.6.2034.0 or later.
Verify the installed version of the Skylight Workspace Config Service to ensure it is no longer below 2.6.2034.0.
Review local user permissions and ensure the "Local Administrator Setting" is configured according to your security policy.
Monitor system logs for any unusual activity related to the Skylight service or unexpected privilege changes.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-7791?

CVE-2026-7791 is a local privilege escalation vulnerability in the Amazon WorkSpaces Skylight Workspace Config Service that allows non-admin users to gain SYSTEM privileges via a TOCTOU race condition.

Which systems are affected by this vulnerability?

Windows WorkSpaces running versions of the Skylight Workspace Config Service below 2.6.2034.0 that have not opted into the "Local Administrator Setting" are affected.