PT-2026-44121 · Microsoft · Ufo

Beanduan22 · Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-46538

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Microsoft UFO version 3.0.1-4-ge2626659

Description The constellation client in this open-source framework for intelligent automation tracks pending task responses using only the session id and fails to verify if a TASK END message originated from the device that initially received the task. While the pending task record includes the expected device ID, the completion path ignores this binding. Consequently, an authenticated peer device can send a forged TASK END message with a matching session id, leading the constellation to accept the response and complete the victim device's pending Future with attacker-controlled result data. This results in an authenticated cross-device task-result injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-294

Related Identifiers

CVE-2026-46538

Affected Products

Ufo

References · 4

• 🔥 https://github.com/microsoft/UFO/security/advisories/GHSA-wmq2-74rj-7pjc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46538 · Security Note
• https://t.me/cveNotify/165000 · Telegram Post
• https://t.me/CVEtracker/55192 · Telegram Post