microsoft UFO vulnerabilities
17 published CVEs name microsoft UFO among the affected products.
- 17Published CVEs17 of them scored
- 17Last 12 monthspublished in the last year
- 2Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-105793
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
microsoft · UFO
Critical9.1 - CVE-2026-105792
Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
microsoft · UFO
Medium6.5 - CVE-2026-105791
Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
microsoft · UFO
High7.5 - CVE-2026-105790
Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
microsoft · UFO
Medium6.4 - CVE-2026-105789
Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
microsoft · UFO
Medium5.4 - CVE-2026-105788
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
microsoft · UFO
High8.8 - CVE-2026-62316
Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution
microsoft · UFO
High8.8 - CVE-2026-73297
Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
microsoft · UFO
Medium6.9 - CVE-2026-73296
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
microsoft · UFO
Critical9.4 - CVE-2026-55440
Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service
microsoft · UFO
Medium6.5