← Back to the live CVE advisory feed

CVE-2026-105788: Product identification pending

Severity

8.8 (HIGH)

Affected versions

Before 3.0.10

Fixed version

3.0.10.

Patch status

Patched

Published

2026-10-06T14:17:40.077

Modified

2026-10-06T16:17:05.597

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.

View the official NVD record for CVE-2026-105788

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.