CVE-2026-105793Critical· 9.1▾ AbyssalPoC availableMicrosoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes i…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.9.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105788High· 8.8Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105791High· 7.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105792Medium· 6.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105790Medium· 6.4Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-105789Medium· 5.4Microsoft UFO is an open-source framework for intelligent automation across devices and platforms
CVE-2026-62316High· 8.8Microsoft UFO open-source framework for intelligent automation across devices and platforms