A critical vulnerability in Microsoft’s open-source UFO Desktop AgentOS could allow remote attackers to access and control Android devices connected via the platform’s Mobile Model Context Protocol (MCP) servers without requiring authentication.
This vulnerability is tracked as CVE-2026-73296 and GHSA-24fq-m9rr-g3mm, carrying a CVSS v3.1 score of 9.4. It affects UFO versions up to and including v3.0.7, and no official patch was available at the time of this disclosure.
Microsoft UFO MCP Flaw
The issue is linked to UFO’s Mobile MCP data-collection and action servers, which expose Android Debug Bridge (ADB)-based functionality over Streamable HTTP.
When operators follow the project’s documented remote-deployment configuration and bind the services to 0.0.0.0, they become accessible on TCP ports 8020 and 8021 to any network client that can reach them.
Port 8020 hosts the mobile data-collection service, while port 8021 runs the mobile action service. According to the advisory, neither service enforced an authentication provider or request-level authorization check in the affected version. This allows unauthenticated MCP clients to initialize sessions and invoke privileged tools.
The data-collection server can expose sensitive information, including screenshots, Android UI hierarchy data, installed application information, window controls, and device metadata.
Attackers could potentially access sensitive material visible on a connected device, including messages, one-time passwords, credentials, personal data, and application content.
The action server presents a greater integrity risk because it can translate MCP requests into ADB commands. Exposed capabilities include tapping screen coordinates, swiping, entering attacker-supplied text, sending key events, launching applications, and clicking on identified UI controls.
The advisory states that exploitation does not require a UFO API key, Galaxy API key, an authenticated UFO session, a pre-existing agent task, browser interaction, user approval, or model cooperation. An attacker only needs network-level access to an exposed service.
The vulnerable implementation directly forwards tool requests to privileged ADB subprocess operations. For example, a request to the tap tool can lead to an ADB shell command that simulates a tap at the attacker’s chosen screen coordinates.
Similarly, the screenshot function captures the device display, retrieves the resulting image, and returns it as Base64-encoded data.
A proof of concept used a non-malicious replacement for the ADB executable that recorded the arguments it received rather than interacting with a real device. This test demonstrated that an unauthenticated request to invoke a tap operation was accepted and reached the simulated ADB command sink.
By default, UFO binds to localhost, which limits exposure in unchanged deployments. However, organizations that expose Mobile MCP servers remotely should immediately restrict access to ports 8020 and 8021 to trusted hosts, eliminate public reachability, and review connected Android devices for any unauthorized activity or data access.
The proposed but unmerged remediation requires a high-entropy bearer token set via the UFO_MCP_API_KEY environment variable. It fails closed if the secret is absent and rejects invalid or missing credentials before any ADB operations occur.
Operators exposing the service remotely should also implement TLS, use an authenticated reverse proxy, or a trusted private tunnel.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
 servers without requiring authentication.){kind=link}