PT-2026-44118 · Microsoft · Ufo

Beanduan22 · Published 2026-05-27 · Updated 2026-05-30 · CVE-2026-46402

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft UFO version 3.0.1-4-ge2626659

Description Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. The software uses the user-controlled task name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in the task name variable, allowing the creation of log directories and log files outside the intended 'logs/' directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-46402

Affected Products

Ufo

References · 5

• 🔥 https://github.com/microsoft/UFO/security/advisories/GHSA-whcg-fgpx-76f2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46402 · Security Note
• https://t.me/cveNotify/164958 · Telegram Post
• https://t.me/cveNotify/165286 · Telegram Post
• https://t.me/CVEtracker/55189 · Telegram Post