Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-73297: Microsoft UFO: IPv6 bypass allows remote access to internal services

CVE-2026-73297 · published 2 months ago

Summary

The Microsoft UFO framework had a security issue that allowed an attacker to access internal services and cloud metadata by sending a specific type of URL. This issue has been fixed in version 3.0.8, which you should update to if you're using UFO. Make sure to apply this update to ensure your system remains secure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	ufo	< 3.0.8

Original advisory text

Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8.

References

https://github.com/microsoft/UFO/releases/tag/v3.0.8 URL
https://github.com/microsoft/UFO/commit/96983c73ed09e884a5f1d7ff8936c953b234b684 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73297... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73297 Vendor Advisory
https://github.com/microsoft/UFO/security/advisories/GHSA-7hrg-r8xr-p8gr Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published12 Aug 2026

Updated31 Oct 2026

First seen12 Aug 2026

Sources

CVE-2026-73297 · NVD

CVE-2026-73297 · MITRE

CVE-2026-73297 · OSV

GHSA-7hrg-r8xr-p8gr · GHSA

Track software like this

Free during beta