Microsoft UFO CVE-2026-73296

Exploitation requires network reachability to the UFO Mobile MCP HTTP servers on TCP 8020 (data collection) and/or 8021 (action) while running a version prior to 3.0.8, and an Android device connected to that server via ADB for the device-facing tools to have effect. No authentication, credentials, or user interaction are needed once the ports are reachable (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment posture: the shipped configuration defaults to host 'localhost', so an out-of-the-box localhost-only setup is not remotely exploitable - real-world risk arises specifically when an operator binds the servers to a LAN or public interface (the documented remote-automation pattern) without firewalling the ports. There is no target-side patch dependency beyond the UFO version, and no non-default feature flag is required - the missing auth was the default behavior for these servers before 3.0.8.

The signals align toward genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and CWE-306 means there is literally no auth barrier to overcome once the port is reachable. The counterweight is deployment context - these servers default to host localhost in the shipped examples, and the documented remote deployments (e.g. 192.168.1.150) are intended for LAN automation rigs, so real exposure hinges on whether an operator bound them to a non-loopback or internet-facing interface. Where they are exposed, impact is severe (full read of screen/UI-tree data plus arbitrary device manipulation), so any operator running UFO's mobile agent on a shared or reachable network should treat this as urgent and patch immediately. There is no KEV listing and no POC referenced, and the vendor supplied no EPSS figure in this input, so exploitation is currently theoretical-but-trivial rather than confirmed in the wild; the missing EPSS and the localhost-default temper the raw 9.4 for the common case, but the effort to weaponize is minimal for any host that is exposed.

An attacker on the same LAN (or able to reach an internet-exposed host) scans for open TCP 8020/8021, connects to the unauthenticated MCP endpoint, and calls get_ui_tree and capture_screenshot to harvest on-screen data including any displayed credentials or messages. They then chain tap, type_text, launch_app, and press_key to drive the ADB-connected Android device - opening apps, exfiltrating data, or altering device state - with no credentials and no user interaction. No POC is referenced, but the low attack complexity makes exploitation straightforward for any reachable server.