Critical Microsoft UFO Flaw Allows Unauthenticated Remote Control of Android Devices
A critical vulnerability (CVE-2026-73296) in Microsoft's UFO automation framework allows unauthenticated attackers to remotely control Android devices via exposed MCP services.
A critical vulnerability in Microsoft’s open-source UFO automation framework, tracked as CVE-2026-73296 with a CVSS score of 9.4, could allow remote attackers to view and control Android devices without authentication or user interaction. The flaw affects Microsoft UFO versions prior to 3.0.8 when the Mobile Model Context Protocol (MCP) services are configured for remote access, enabling attackers to initialize sessions and execute sensitive actions without valid credentials.
UFO includes Mobile MCP servers designed to collect data from and automate Android devices connected via Android Debug Bridge (ADB). These services can be exposed over HTTP for remote use, with the vulnerable data-collection server listening on TCP port 8020 and the action server on TCP port 8021. When administrators bind these services to 0.0.0.0 for remote deployment, any system able to reach these ports may be able to leverage the Android automation functions.
The vulnerability, categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization), stems from the servers failing to enforce authentication before accepting MCP requests. This allows attackers to bypass security measures and directly interact with the device.
An exposed Mobile MCP data server can expose highly sensitive information, including screenshots, UI hierarchy details, installed application lists, window-control data, and Android device metadata. This could reveal chat messages, email content, one-time passwords, account details, and other private information displayed on the device screen.
The action server poses a more significant threat, as it exposes ADB-backed control features. An unauthenticated attacker can tap arbitrary screen locations, swipe, type text, trigger Android key events, launch applications, and interact with user interface controls, effectively mimicking an automation workflow.
While the default UFO configuration binds Mobile MCP services to localhost, limiting exposure in unchanged installations, the vulnerability becomes particularly dangerous when administrators deliberately expose these services for remote access. Organizations running UFO with ADB-connected Android devices or emulators should verify the reachability of ports 8020 and 8021 from other systems.
Microsoft has released UFO version 3.0.8 to address the problem, introducing mandatory bearer token authentication via the UFO_MCP_API_KEY environment variable. Until all systems are updated, organizations are advised to restrict Mobile MCP services to localhost, block inbound access to ports 8020 and 8021, and avoid direct internet exposure. Secure remote deployments should utilize TLS, authenticated reverse proxies, or trusted private tunnels.
Security teams should proactively identify hosts running UFO, review ADB-connected devices and emulators, rotate any credentials that may have been exposed on device screens, and investigate unusual automation activity. Prompt action is crucial to prevent potential incidents arising from slow investigations into suspicious device behavior.