# CVE-2026-105793: Microsoft UFO command injection in Mobile MCP press_key

Source: https://junglewise.ai/threats/cve-2026-105793-microsoft-ufo-is-an-open-source-framework-for-intelligent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105793 · Severity: critical · CVSS 9.1 · Published 2026-10-06

Microsoft UFO is an automation framework that controls devices remotely through APIs. An authenticated attacker with a valid API key can inject arbitrary shell commands through the press_key tool, allowing them to execute code on connected Android devices. This requires the attacker to already possess the API key and have network access to the UFO Mobile MCP server.

Technologies: [Microsoft UFO](https://junglewise.ai/threats/technologies/ufo). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-105793 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105793 being exploited in the wild.

**How severe is CVE-2026-105793?** Critical severity, with a CVSS score of 9.1, published 6 October 2026.

**Which products and versions are affected?** Microsoft UFO prior to 3.0.9.

**Is there a fix for CVE-2026-105793?** Yes: fixed in 3.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105793 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105793?** Check whether you run Microsoft UFO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.9

## Technical details

The press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts an unsanitized key_code parameter and passes it directly to `adb shell input keyevent`, allowing command injection via shell metacharacters. An authenticated MCP caller with a valid UFO_MCP_API_KEY can inject additional commands executed as the Android shell user on an authorized connected device. The vulnerability requires adb connectivity to an authorized device but does not escalate to host OS execution or Android root privileges.

## Affected products

- Microsoft UFO prior to 3.0.9

## Timeline

- 2026-10-06: disclosed
- 2026-09-11: patched: Fix committed prior to advisory publication

## References

- [https://github.com/microsoft/UFO/commit/a538791043327a0c33731d5be428867a5fd71794](https://github.com/microsoft/UFO/commit/a538791043327a0c33731d5be428867a5fd71794)
- [https://github.com/microsoft/UFO/releases/tag/v3.0.9](https://github.com/microsoft/UFO/releases/tag/v3.0.9)

## Related threats

- [Microsoft UFO deadlock in task result endpoint](https://junglewise.ai/threats/cve-2026-105792-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO command injection in run_shell via explorer.exe](https://junglewise.ai/threats/cve-2026-105791-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO WebSocket SSRF IP pinning bypass in device registration](https://junglewise.ai/threats/cve-2026-105790-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO command allowlist bypass in Linux MCP server](https://junglewise.ai/threats/cve-2026-105789-microsoft-ufo-is-an-open-source-framework-for-intelligent)
- [Microsoft UFO authenticated Android shell command injection in Mobile MCP](https://junglewise.ai/threats/cve-2026-105788-microsoft-ufo-is-an-open-source-framework-for-intelligent)