Amazon WorkSpaces Skylight Agent Race Condition Allows Local Privilege Escalation
A time-of-check to time-of-use flaw in the Skylight agent lets local users gain SYSTEM rights. AWS advises rebooting Windows WorkSpaces to apply the fix.
Key points
- CVE-2026-7791 affects Amazon WorkSpaces Skylight Workspace Config Service versions prior to 2.6.2034.0.
- The vulnerability enables local non-admin users to escalate privileges to SYSTEM via a race condition.
- AWS classifies the bulletin as Important and recommends rebooting affected WorkSpaces to update the service.
Amazon WorkSpaces customers face a local privilege escalation risk in the Skylight Workspace Config Service. AWS identified CVE-2026-7791, which exploits a race condition during log file archival. The flaw allows a local non-admin authenticated user to escalate privileges to SYSTEM. This issue impacts Amazon WorkSpaces customers using Windows WorkSpaces that have not opted-in to enable the Local Administrator Setting on their directory.
The risk
The vulnerability stems from a time-of-check to time-of-use race condition in how the slwsconfigservice handles log archival. An attacker with local access but no admin rights can exploit this timing gap to escalate privileges to SYSTEM. The source material does not state that the attacker seizes control of the service or gains full control over the WorkSpace instance. It only confirms the privilege escalation capability. No further consequences regarding data exposure or integrity are stated in the advisory.
Who is exposed
Only Windows WorkSpaces are affected by this specific configuration flaw. The issue is present in environments where the Local Administrator Setting is not enabled for the directory. Organizations using Linux WorkSpaces or Windows WorkSpaces with local admin rights enabled are not exposed to this specific attack vector. The flaw affects all versions of the Skylight Workspace Config Service prior to 2.6.2034.0.
Cost and compliance
AWS has not disclosed financial costs or specific compliance impacts in its advisory. The bulletin is classified as Important, requiring attention from administrators. No regulatory fines or breach notification requirements are mentioned in the source material. Customers should assess internal policies regarding local privilege escalation risks to determine if further reporting is necessary for their specific compliance frameworks.
What to watch
Monitor for unexpected service restarts or permission changes on the slwsconfigservice. Look for new processes running with SYSTEM privileges initiated by standard user accounts. Administrators should track the version number of the Skylight Workspace Config Service across their fleet. Ensure all Windows WorkSpaces are rebooted to trigger the automatic update to version 2.6.2034.0.
Signals worth monitoring
Teams usually check security logs for sudden privilege changes on background services like configuration agents. Look for unauthorized access to system directories or modifications to log files during archival windows. Check whether standard user accounts have spawned high-privilege processes unexpectedly. Verify that service integrity checks pass after reboots. Contain potential compromises by isolating affected WorkSpaces and auditing user activity logs for lateral movement indicators.
What to do and how to stay safe
- Reboot all Windows WorkSpaces that do not have the Local Administrator Setting enabled to apply the fix.
- Verify that the Skylight Workspace Config Service has
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
