Microsoft UFO EUVD-2026-93406

Requires an authenticated caller with access to the UFO execute_command tool on a deployed Linux MCP HTTP server (ufo/client/mcp/http_servers/linux_mcp_server.py) in a version prior to 3.0.9. The attacker supplies a free-form command using the file-output forms of allow-listed binaries - 'sort -o <file>' / 'sort --output=<file>' or the optional second operand of 'uniq <in> <out>' - which the binary opens and overwrites directly, bypassing the argument policy without shell metacharacters. LIMITING FACTORS: authentication is required (PR:L, not unauthenticated); writes are confined to paths writable by the UFO server process (not arbitrary system files); there is no confidentiality disclosure and no code execution; the Linux MCP server component must actually be enabled/exposed.

This is a genuine but moderate-severity integrity/availability issue, not a top-tier priority. The provided CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L, base 5.4) scores it as network-reachable but gated by authentication (PR:L), high attack complexity, and required user interaction. Critically, the 'RCE' tag CONFLICTS with the description, which explicitly states the demonstrated primitive 'does not directly disclose files or establish arbitrary code execution' - this is an argument-injection file-overwrite (CWE-88), not remote code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis; the only exploitation evidence is the vendor's own security regression test suite added in the fix commit. The real-world ceiling is corruption of files writable by the UFO server process (config/data tampering and service disruption), not confidentiality loss or code execution. Net: a real, patch-worthy flaw for anyone running the Linux MCP server, but low widespread-exploitation risk given it requires an authenticated caller and the affected product is a niche research framework.

An authenticated user of a deployed UFO Linux MCP server invokes the execute_command tool with a command such as 'sort -o /path/to/config data.txt' (or the second-operand file-output form of uniq). Because sort/uniq are allow-listed as read-only, the binary itself opens and overwrites the destination without any shell metacharacters, corrupting server-writable configuration or data and disrupting the service. No public exploit code is identified; exploitation is demonstrated only by the vendor's own regression tests.