Advisories · Technology
microsoft UFO.
Every CVE that names microsoft UFO among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
- microsoft UFO
- Command injection
- CVSS 6.5 Medium
Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
- microsoft UFO
- Denial of service
- CVSS 7.5 High
Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
- microsoft UFO
- Command injection
- CWE-184
- CVSS 6.4 Medium
Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
- microsoft UFO
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
- microsoft UFO
- Command injection
- CWE-184
- CVSS 8.8 High
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
- microsoft UFO
- Command injection
- CVSS 8.8 High
Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution
- microsoft UFO
- Information disclosure
- CWE-346
- CVSS 6.9 Medium
Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
- microsoft UFO
- Server-side request forgery (SSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
- microsoft UFO
- Authentication bypass
- Broken access control
- CVSS 6.5 Medium
Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service
- microsoft UFO
- Denial of service
- Broken access control
- CVSS 4.3 Medium
Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
- microsoft UFO
- Broken access control
- CVSS 5.9 Medium
Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection
- microsoft UFO
- Authentication bypass
- CWE-345
- CVSS 6.3 Medium
Microsoft UFO shared WebSocket handler state causes cross-client response hijacking
- microsoft UFO
- Broken access control
- CWE-488
- CVSS 8.8 High
Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking
- microsoft UFO
- Authentication bypass
- Broken access control
- CVSS 8.1 High
Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory
- microsoft UFO
- Path traversal
- CVSS 5.3 Medium
Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters
- microsoft UFO
- Broken access control
- CVSS 7.8 High
OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON
- microsoft UFO
- Command injection