Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.9.
Critical 9.1
CVE-2026-105793
Microsoft UFO — command injection.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms.
WeaknessCWE-78: Command injection
Published Source NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Exploit chance, 30 days
0.9%
Higher than 58% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Microsoft UFO, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
Also actively exploited
Other CVEs from Microsoft
40+ more CVEs, 1 actively exploited
8.8Microsoft Windows — Command Injection.ExploitedEPSS 9.8%10.0Microsoft Entra application proxy — authentication bypass.EPSS 0.6%10.0Microsoft Azure Kubernetes Configuration Service — missing authentication.EPSS 0.7%10.0Microsoft VM Inspector for Azure Virtual Machines — Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual…EPSS 0.9%9.1Microsoft Azure Pipelines — command injection.EPSS 0.7%9.6Microsoft Visual Studio Code — path traversal.EPSS 0.8%