Microsoft Ufo vulnerabilities

• microsoft ufo Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key` CVE-2026-105793 9.1 CriticalOctober 6, 2026
• microsoft ufo Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager CVE-2026-105792 6.5 MediumOctober 6, 2026
• microsoft ufo Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection CVE-2026-105791 7.5 HighOctober 6, 2026
• microsoft ufo Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects CVE-2026-105790 6.4 MediumOctober 6, 2026
• microsoft ufo Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool CVE-2026-105789 5.4 MediumOctober 6, 2026
• microsoft ufo Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app CVE-2026-105788 8.8 HighOctober 6, 2026
• microsoft ufo Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution CVE-2026-62316 8.8 HighAugust 21, 2026
• microsoft ufo Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation CVE-2026-73297 6.9 MediumAugust 12, 2026
• microsoft ufo Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure CVE-2026-73296 Public exploit 9.4 CriticalAugust 12, 2026
• microsoft ufo Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service CVE-2026-55440 6.5 MediumJuly 16, 2026
• microsoft ufo Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info CVE-2026-54568 4.3 MediumJuly 16, 2026
• microsoft ufo Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection CVE-2026-46538 5.9 MediumMay 27, 2026
• microsoft ufo Microsoft UFO shared WebSocket handler state causes cross-client response hijacking CVE-2026-46416 6.3 MediumMay 27, 2026
• microsoft ufo Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking CVE-2026-46414 8.8 HighMay 27, 2026
• microsoft ufo Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory CVE-2026-46402 8.1 HighMay 27, 2026
• microsoft ufo Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters CVE-2026-46544 5.3 MediumMay 27, 2026
• microsoft ufo OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON CVE-2026-45322 7.8 HighMay 27, 2026