Amazon Workspaces vulnerabilities

3 CVEs affecting Amazon Workspaces, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-7791, published 2026-05-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-43638, published 2021-12-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode…
CVE-2021-43637, published 2021-12-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause…
CVE-2026-7791, published 2026-05-04. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to…