Microsoft UFO is an open-source framework for intelligent automation across devices and platforms.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft, Google
- Product
- android
- CVSS
- 9.1
- EPSS
- 0.009 (p58)
- Exposure class
- Mobile OS
Why it ranks 29 (Notable)
- CVSS 9.1 critical
- Product class: mobile OS
- Widely deployed vendor product (Microsoft)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-105793 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.