microsoft UFO vulnerabilities

Newest CVEs

• CVE-2026-105793

  Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

  microsoft · UFO

  Critical9.1
• CVE-2026-105792

  Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager

  microsoft · UFO

  Medium6.5
• CVE-2026-105791

  Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

  microsoft · UFO

  High7.5
• CVE-2026-105790

  Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

  microsoft · UFO

  Medium6.4
• CVE-2026-105789

  Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

  microsoft · UFO

  Medium5.4
• CVE-2026-105788

  Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

  microsoft · UFO

  High8.8
• CVE-2026-62316

  Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

  microsoft · UFO

  High8.8
• CVE-2026-73297

  Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation

  microsoft · UFO

  Medium6.9
• CVE-2026-73296

  Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

  microsoft · UFO

  Critical9.4
• CVE-2026-55440

  Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service

  microsoft · UFO

  Medium6.5