Vulnerability Report

CVE-2026-73296

Title: Unauthenticated device control in Microsoft UFO

Auth Bypass

Proof Of Concept

PoC Available for CVE-2026-73296

CWE Category CWE-306

Published Date Aug 12, 2026

Modified Date Sep 18, 2026

Exploit Status Available

Score 9.4 CVSS v3.1

Exploit Probability (EPSS)

3.65%

Vulnerability Summary

CVE-2026-73296: Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/microsoft/UFO/commit/e562d10060b077dedae93e0fd58c1ee379558962 https://github.com/microsoft/UFO/releases/tag/v3.0.8 https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-73296 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/0xBlackash/CVE-2026-73296

View Code

September 18, 2026 MODIFIED

Vulnerability data updated via NVD.

August 13, 2026 MODIFIED

Vulnerability data updated via NVD.

August 12, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Stack

No specific products linked.