(2025.06 - 2026.03) Pre-auth remote code execution in DCV Session Manager broker

## Bug description

The DCV Session Manager broker installed on RES broker hosts includes Apache Ignite < 2.17.0, which is affected by CVE-2024-52577, a pre-authentication remote code execution vulnerability via unsafe Java deserialization. An attacker with network access to the broker could execute arbitrary code on the broker host.

## Affected versions

2025.06 - 2026.03

## Mitigation

The fix is delivered via the upstream DCV Session Manager broker package (version 2025.0.561), which upgrades Apache Ignite to 2.18.0. RES environments pull the latest broker RPM from CloudFront using unversioned URLs, so the fix is automatically picked up when a new broker host is launched.

To apply the fix, cycle the current DCV broker instance and let the Auto Scaling Group launch a new one with the patched broker package. We strongly recommend running these CLI commands in [AWS CloudShell](https://aws.amazon.com/cloudshell/) — a free, browser-based shell pre-authenticated with your console credentials.

1. Configure the AWS CLI for the account/region where RES is deployed.
2. Terminate the current broker instance:

```
ENVIRONMENT_NAME=

INSTANCE_ID=$(aws ec2 describe-instances \
--filters \
Name=tag:Name,Values=${ENVIRONMENT_NAME}-vdc-broker \
Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME} \
--query "Reservations[0].Instances[0].InstanceId" \
--output text)

aws ec2 terminate-instances --instance-ids ${INSTANCE_ID}
```

1. The Auto Scaling Group will automatically launch a new broker instance with the latest DCV Session Manager broker package containing the fix.
2. Verify the new DCV Broker instance is healthy by checking that its associated target groups show a healthy status in the Amazon EC2 console under **Load Balancing > Target Groups**. Look for target groups containing `-broker` in the name for your environment.
3. Connect to the new broker instance and verify the broker version is `2025.0.561` or higher:

```
rpm -q nice-dcv-session-manager-broker
# Expected output: nice-dcv-session-manager-broker-2025.0.561-1.amzn2023.noarch (or higher)
```

### Rollback

No rollback is needed. The fix is a standard upstream package upgrade of the DCV Session Manager broker. The new broker instance will always pull the latest available version from CloudFront. Rolling back would require pinning an older broker version, which is not recommended as it would reintroduce the vulnerability.

Review the mitigation steps and AWS CLI commands in the issue, then inspect the DCV broker instance and its associated target groups. Cycle the broker instance so the Auto Scaling Group launches a patched package, verify the target is healthy, and confirm that rpm reports nice-dcv-session-manager-broker version 2025.0.561 or higher.

Written by the indexing model from the issue text.