Quick answers
- Is CVE-2026-46544 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46544 being exploited in the wild.
- How severe is CVE-2026-46544?
- Medium severity, with a CVSS score of 5.3, published 27 May 2026.
- Which products and versions are affected?
- Microsoft UFO 3.0.1-4-ge2626659.
- Is there a fix for CVE-2026-46544?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-46544 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-46544?
- Check whether you run Microsoft UFO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Microsoft UFO (specifically version 3.0.1-4-ge2626659) is vulnerable to an authenticated cross-client stale result replay. The vulnerability exists because the `SessionManager` reuses existing in-memory session objects if a client-supplied `session_id` matches an existing one, without verifying ownership or device binding. If a session has completed but remains in memory, a different authenticated client can send a WebSocket `TASK` message with that `session_id` to trigger the `send_task_end()` callback, which returns the previous session's results to the new requester. The risk is elevated because some session IDs are derived from predictable application identifiers rather than random server-generated secrets. No patch was available at the time of the advisory.
Affected products
- Microsoft UFO 3.0.1-4-ge2626659
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD