CVE-2026-45322: OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON

Synopsis

OS command injection in Microsoft UFO (an open-source intelligent automation framework) allows any attacker with write access to a session or action JSON file on the host to execute arbitrary operating system commands. The vulnerability is reached locally; a low-privileged account is sufficient, and no victim interaction is needed. When a poisoned session is resumed or replayed, UFO passes the planted command directly to PowerShell via subprocess.Popen with shell=True, giving the attacker full code execution as the UFO process user. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege OS account with write access to the session or action JSON files is sufficient; no administrative privileges are needed.

• Victim interactionNot required

  No user action is required; exploitation occurs automatically when UFO resumes or replays the poisoned session.

• Attack complexityDetail

  The exploit is reliable and condition-free: writing a crafted command string into a JSON file and waiting for session replay requires no race conditions or special environmental setup.

Blast Radius

• Reads any files and secrets accessible to the UFO process user, including stored session tokens, credentials, and configuration data on the host.
• Modifies or deletes files owned by the UFO process user, including session records, automation scripts, and application data.
• Executes arbitrary PowerShell commands as the UFO process user, enabling lateral movement, persistence mechanisms, or further privilege escalation on the host.
• Crashes or disrupts the UFO automation service by terminating processes or corrupting state files the service depends on.