Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46416

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b5674b87231bcc8d4db85fa90da1ea1658dfa930d22b9f8b946d29ab3c385f94
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-488","description":"CWE-488: Exposure of Data Element to Wrong Session","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"UFO","vendor":"microsoft","versions":[{"status":"affected","version":"3.0.1-4-ge2626659"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-488","description":"CWE-488: Exposure of Data Element to Wrong Session","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/microsoft/UFO/security/advisories/GHSA-cwwh-p9rv-4pj4","tags":["x_refsource_CONFIRM"],"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-cwwh-p9rv-4pj4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-cwwh-p9rv-4pj4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9e0a705981e705794d10883f0352049f6c3d3adee45e180d600be00c3d5c8292 · sha256:fdcd37775f199077… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer