Microsoft Ufo vulnerabilities

17 CVEs affecting Microsoft Ufo, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105793, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-73296, published 2026-08-12. Critical severity, CVSS 9.4. EPSS: 3.7% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in…
CVE-2026-73297, published 2026-08-12. Medium severity, CVSS 6.9. EPSS: 2.9% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and…
CVE-2026-45322, published 2026-05-27. High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in…
CVE-2026-55440, published 2026-07-16. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in…
CVE-2026-105788, published 2026-10-06. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in…
CVE-2026-46402, published 2026-05-27. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing…
CVE-2026-54568, published 2026-07-16. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call…
CVE-2026-105793, published 2026-10-06. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a…
CVE-2026-46414, published 2026-05-27. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role…
CVE-2026-105789, published 2026-10-06. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats…

Latest

CVE-2026-105792, published 2026-10-06. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task()…
CVE-2026-105791, published 2026-10-06. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of…
CVE-2026-105790, published 2026-10-06. Medium severity, CVSS 6.4. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted…
CVE-2026-62316, published 2026-08-21. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to…