The vulnerability exists in the COMMAND_RESULTS handler of Microsoft UFO. When an authenticated client invokes this handler, the server executes get_or_create_session without providing an owner_client_id, allowing the attacker to specify a session_id such as task_name@task_id. This creates an unowned session that the attacker can use to deny legitimate owners from using the session or, when repeated, to accumulate phantom sessions that exhaust system memory.

The affected product is Microsoft UFO versions 3.0.6 and earlier. The flaw is contained in the ufo/server/ws/handler.py module of the open‑source framework and is present on any platform supported by UFO. All deployments that provide authenticated command execution are susceptible, regardless of operating system or network topology.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation and the vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated client that can invoke COMMAND_RESULTS; there is no need for privileged access or network infiltration beyond standard authenticated usage. The impact is denial of service or memory exhaustion through session squatting, presenting a moderate but avoidable risk that can be mitigated with an upgrade or code changes.