PT-2026-44117 · Microsoft · Ufo

Beanduan22 · Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-45322

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.1

Description An OS command injection issue exists in the shell action replay path. The functions ShellReceiver.run shell() and ShellReceiver.execute command() pass command strings from action parameters directly to subprocess.Popen() using shell=True and executable=powershell.exe. These functions are triggered by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters. Since the framework stores planned and executed actions in per-session JSON records, an attacker capable of writing or modifying these JSON files can plant a shell action. This allows the execution of arbitrary commands as the process user when the session is resumed or replayed.

Recommendations Update to a version later than 3.0.0.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-45322

Affected Products

Ufo

References · 5

• 🔥 https://github.com/microsoft/UFO/security/advisories/GHSA-wj72-7w8h-695f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45322 · Security Note
• https://t.me/cveNotify/164957 · Telegram Post
• https://t.me/CVEtracker/55188 · Telegram Post
• https://t.me/cveNotify/165084 · Telegram Post