AWS Fixes Loom for AWS Admin Takeover and SageMaker Unified Studio Code Execution Flaws

AWS published bulletins on four CVEs affecting Loom for AWS and SageMaker Unified Studio: a critical admin takeover vulnerability in Loom (CVE-2026-103956), two SSRF/OAuth flaws in Loom that can expose credentials (CVE-2026-103957, CVE-2026-103958), and an OS command injection in SageMaker Spaces that can let a project member execute code in another user’s Space (CVE-2026-104019). Patches are available and AWS reports no confirmed in-the-wild exploitation; recommended actions include upgrading affected components, rotating OAuth client secrets, reissuing tokens, restarting Spaces, and reviewing CloudTrail.