CVE-2026-105788High· 8.8▾ MidnightPoC availableMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-cont…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105793Critical· 9.1Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105791High· 7.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105789Medium· 5.4Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-62316High· 8.8Microsoft UFO open-source framework for intelligent automation across devices and platforms
CVE-2026-105792Medium· 6.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105797High· 8.8SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions