Microsoft UFO CVE-2026-105788

Requires three concrete prerequisites stated in the advisory: (1) a valid Mobile MCP API key to authenticate to the Mobile MCP server; (2) an Android device that is reachable and already authorized for ADB and connected to that server; and (3) UFO prior to 3.0.10 exposing the vulnerable type_text/launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py. The attacker then supplies shell metacharacters in the text or package_name parameter. Limiting factors that reduce real-world risk: authentication (API key) is mandatory, a pre-authorized ADB device must exist, and resulting execution is confined to Android shell-user privileges - it does NOT yield host OS code execution or Android root.

This is a CWE-78 command injection in Microsoft UFO's Mobile MCP server (type_text/launch_app) carrying a vendor/NVD CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The network vector and low complexity argue for easy exploitation, but PR:L is the decisive modifier: exploitation requires a valid Mobile MCP API key AND a reachable device already authorized for ADB, so this is not an unauthenticated internet-wide condition and is poorly suited to opportunistic/wormable abuse. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation - exploitation status here is 'no public exploit identified at time of analysis,' though the fix commit's security test suite explicitly enumerates working injection payloads (e.g. 'a;id', 'a$(id)', 'com.example||id'), which materially lowers the bar for an attacker who already holds API access. The signals are consistent rather than conflicting: a genuinely high technical impact (full shell-user command execution on the device) gated behind authentication and a specific deployment (connected ADB-authorized Android device). Net: a real priority for the subset of environments actually running UFO's Mobile MCP server against live devices, but the authentication and device-authorization prerequisites make the realistic threat targeted/insider-adjacent rather than mass-exploitable. The description's note that impact is capped at the Android shell user (no host OS execution, no Android root) further bounds blast radius relative to the raw 8.8.

An actor holding a valid Mobile MCP API key reaches the UFO Mobile MCP server (prior to 3.0.10) that is driving an ADB-authorized Android device, then calls launch_app or type_text with a package_name/text value containing shell metacharacters (e.g. 'com.example;toybox${IFS}id'). Because the parameter is joined into the adb shell command string and reparsed by the Android shell, the injected command runs as the Android shell user on the connected device. No standalone public exploit is identified, but the vendor's fix-commit test cases demonstrate the exact injection payloads.