Product by Microsoft

    UFO

    17 known vulnerabilities in UFO (Microsoft), 0 of them actively exploited (CISA KEV).

    Key figures

    17

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in UFO (Microsoft)
    CriticalCVE-2026-73296

    Microsoft UFO: Missing Authentication for Critical Function

    		9.4
    MediumCVE-2026-73297

    Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation

    		—
    HighCVE-2026-45322

    OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON

    		7.8
    HighCVE-2026-105788

    Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

    		8.8
    CriticalCVE-2026-105793

    Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

    		9.1
    HighCVE-2026-105791

    Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

    		7.5
    MediumCVE-2026-105792

    Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager

    		6.5
    HighCVE-2026-62316

    Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

    		8.8
    HighCVE-2026-46402

    Microsoft UFO: Path Traversal

    		8.1
    HighCVE-2026-46414

    Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking

    		8.8
    MediumCVE-2026-105789

    Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

    		5.4
    MediumCVE-2026-105790

    Microsoft UFO: Server-Side Request Forgery (SSRF)

    		6.4
    MediumCVE-2026-55440

    Microsoft UFO: Uncontrolled Resource Consumption

    		6.5
    MediumCVE-2026-54568

    Microsoft UFO: Authorization Bypass Through User-Controlled Key

    		4.3
    MediumCVE-2026-46544

    Microsoft UFO: Authorization Bypass Through User-Controlled Key

    		5.3
    MediumCVE-2026-46416

    Microsoft UFO shared WebSocket handler state causes cross-client response hijacking

    		6.3
    MediumCVE-2026-46538

    Microsoft UFO: Authentication Bypass by Capture-replay

    		5.9

    News

    All products by Microsoft