Microsoft UFO

• CVE-2026-105793 Critical 9.1 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key` 0.9%
• CVE-2026-105792 Medium 6.5 Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager 0.7%
• CVE-2026-105791 High 7.5 Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection 0.7%
• CVE-2026-105790 Medium 6.4 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects 0.5%
• CVE-2026-105789 Medium 5.4 Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool 0.7%
• CVE-2026-105788 High 8.8 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app 1.1%
• CVE-2026-62316 High 8.8 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution 0.5%
• CVE-2026-73297 Medium 6.9 Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation 2.9%
• CVE-2026-73296 Critical 9.4 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure 3.7%
• CVE-2026-55440 Medium 6.5 Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service 0.7%
• CVE-2026-54568 Medium 4.3 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info 0.6%
• CVE-2026-46538 Medium 5.9 Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection 0.2%
• CVE-2026-46416 Medium 6.3 Microsoft UFO shared WebSocket handler state causes cross-client response hijacking 0.3%
• CVE-2026-46414 High 8.8 Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking 0.6%
• CVE-2026-46402 High 8.1 Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory 0.7%
• CVE-2026-46544 Medium 5.3 Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters 0.5%
• CVE-2026-45322 High 7.8 OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON 2.4%