CVE-2026-55440 - Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service

CVE ID :CVE-2026-55440 Published : July 16, 2026, 3:35 p. m. | 41 minutes ago Description :Microsoft UFO open-source framework for intelligent automation across devices and platforms.

Prior to 3. 0. 7, the COMMAND_RESULTS handler in ufo/server/ws/handler.

py called get_or_create_session in ufo/server/services/session_manager.