Technology · Microsoft
Microsoft UFO vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 15 vulnerabilities in Microsoft UFO: 0 in the last 7 days and 7 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105793, was published on 6 October 2026. Nothing in the last four weeks, down from 6 vulnerabilities in the four before. 0 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 7
- Critical, all time
- 1
- Exploited in the wild
- 0
About Microsoft UFO
UFO (Universal Font Object) is a library for reading and writing UFO font files.
Latest Microsoft UFO vulnerabilities
- CVE-2026-105793: Microsoft UFO command injection in Mobile MCP press_keycriticalCVSS 9.1
- CVE-2026-105792: Microsoft UFO deadlock in task result endpointmediumCVSS 6.5
- CVE-2026-105791: Microsoft UFO command injection in run_shell via explorer.exehighCVSS 7.5
- CVE-2026-105790: Microsoft UFO WebSocket SSRF IP pinning bypass in device registrationmediumCVSS 6.4
- CVE-2026-105789: Microsoft UFO command allowlist bypass in Linux MCP servermediumCVSS 5.4
- CVE-2026-105788: Microsoft UFO authenticated Android shell command injection in Mobile MCPhighCVSS 8.8
- CVE-2026-62316: Microsoft UFO DNS rebinding bypass leading to file read and command executionhighCVSS 8.8EPSS 0.5%
- CVE-2026-55440: Microsoft UFO session squatting denial of service in COMMAND_RESULTS handlermediumCVSS 6.5
- CVE-2026-54568: Microsoft UFO authorization bypass in WebSocket handlermediumCVSS 4.3
- CVE-2026-46544: Microsoft UFO stale result replay via session ID reusemediumCVSS 5.3
- CVE-2026-46538: Microsoft UFO Task Result Injection in Constellation ClientmediumCVSS 5.9
- CVE-2026-46416: Microsoft UFO session confusion in UFOWebSocketHandlermediumCVSS 6.3
- CVE-2026-46414: Microsoft UFO role spoofing and task hijacking in WebSocket control planehighCVSS 8.8
- CVE-2026-46402: Microsoft UFO path traversal in session log creationhighCVSS 8.1
- CVE-2026-45322: Microsoft UFO OS command injection in shell action replayhighCVSS 7.8
Most severe Microsoft UFO vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-105793: Microsoft UFO command injection in Mobile MCP press_keycriticalCVSS 9.1
- CVE-2026-62316: Microsoft UFO DNS rebinding bypass leading to file read and command executionhighCVSS 8.8EPSS 0.5%
- CVE-2026-105788: Microsoft UFO authenticated Android shell command injection in Mobile MCPhighCVSS 8.8
- CVE-2026-46414: Microsoft UFO role spoofing and task hijacking in WebSocket control planehighCVSS 8.8
- CVE-2026-46402: Microsoft UFO path traversal in session log creationhighCVSS 8.1
- CVE-2026-45322: Microsoft UFO OS command injection in shell action replayhighCVSS 7.8
- CVE-2026-105791: Microsoft UFO command injection in run_shell via explorer.exehighCVSS 7.5
- CVE-2026-105792: Microsoft UFO deadlock in task result endpointmediumCVSS 6.5
- CVE-2026-55440: Microsoft UFO session squatting denial of service in COMMAND_RESULTS handlermediumCVSS 6.5
- CVE-2026-105790: Microsoft UFO WebSocket SSRF IP pinning bypass in device registrationmediumCVSS 6.4
Vulnerabilities per week
Nothing in the last four weeks, down from 6 vulnerabilities in the four before. 0 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 6 | 1 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Microsoft UFO vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/ufo)<a href="https://junglewise.ai/threats/technologies/ufo"><img src="https://junglewise.ai/threats/technologies/ufo/badge.svg" alt="Microsoft UFO vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/ufo.json, and this page as text at https://junglewise.ai/threats/technologies/ufo.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Microsoft UFO vulnerabilities", https://junglewise.ai/threats/technologies/ufo, 11 November 2026.