Executive Summary
A local privilege escalation (LPE) vulnerability, designated as CVE-2026-7791, has been discovered in the Amazon Skylight Workspace Config Service, a component running as NT AUTHORITY\SYSTEM on Amazon WorkSpaces Windows instances. The flaw arises from a combination of overly permissive directory ACLs, a Time-of-Check to Time-of-Use (TOCTOU) race condition during log rotation, and a lack of file type validation. This allows an authenticated low-privileged user to write arbitrary files to restricted system locations.
The attack chain leverages Windows junction points to redirect SYSTEM-level file move operations to attacker-specified paths, such as service directories or startup folders. By successfully winning a race condition during the service's log rotation flow—which occurs approximately every 20 minutes—an attacker can plant malicious DLLs or configuration files to achieve full host compromise.
This vulnerability is particularly critical for organizations using WorkSpaces for standard employees who are typically restricted from administrative access. AWS has released a fix in Skylight version 2.6.2034.0, which is generally deployed automatically via managed images; however, organizations should verify their current version to ensure remediation.