A critical vulnerability in Microsoft’s UFO agentic automation framework exposes Android devices to a complete, unauthenticated remote takeover.
Tracked as CVE-2026-73296 with a CVSS score of 9.4, the flaw affects UFO versions up to and including v3.0.7, with no patched version currently available.
The vulnerability resides in the Mobile MCP (Model Context Protocol) implementation at ufo/client/mcp/http_servers/mobile_mcp_server.py, where two Streamable HTTP servers a data-collection server on port 8020 and an action server on port 8021 are constructed without any authentication provider or authorization check.
Critical Microsoft UFO MCP Flaw
When deployed per Microsoft’s own documented remote configuration, which binds these services to 0.0.0.0, any network client capable of reaching the ports can initiate an MCP session and invoke ADB-backed tools without an API key, session token, or user approval.
Once a request reaches the server, it flows directly into privileged ADB subprocess calls with no gatekeeping.
On the data side, attackers can call capture_screenshot, get_ui_tree, get_device_info, and related functions to exfiltrate screen contents, UI hierarchy, installed apps, and device metadata .
On the action side, functions including tap, swipe, type_text, launch_app, press_key, and click_control let an attacker inject arbitrary input events into a connected Android device.
Researcher rhmsd demonstrated this with a proof-of-concept replacing the real ADB binary with a marker-writing test helper; an unauthenticated tap(17, 29) call was accepted and reached the fake sink, confirmed by the output result=CallToolResult(...{"success":true,"action":"tap(17, 29)"}...) .
| CIA dimension | Impact |
|---|---|
| Confidentiality | High — screenshots, credentials, OTPs, and app data may be exposed |
| Integrity | High — arbitrary taps, swipes, text entry, and app launches |
| Availability | Low — repeated automated input can disrupt device use |
The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L reflects network-exploitable, low-complexity access requiring no privileges or user interaction. The issue maps to CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization) .
Mitigation
No official patch exists yet, though a locally developed fix requiring a high-entropy bearer token via UFO_MCP_API_KEY, constant-time comparison, and fail-closed startup has been verified but not merged upstream.
Until an upstream patch ships, operators exposing Mobile MCP servers on non-loopback interfaces should revert to localhost binding, place services behind TLS, and use an authenticated reverse proxy or a private tunnel. The default CLI binding remains localhost, which limits exposure for unmodified deployments.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
