Critical Vulnerability in Microsoft’s UFO Desktop AgentOS Poses Significant Risk to Android Devices
A newly discovered vulnerability within Microsoft’s open-source UFO Desktop AgentOS presents a serious threat to Android devices connected via its Mobile Model Context Protocol (MCP) servers. This flaw enables remote attackers to gain unauthorized access and control over these devices without requiring any form of authentication, escalating the potential for exploiting sensitive user data.
This vulnerability is identified with two tracking numbers, CVE-2026-73296 and GHSA-24fq-m9rr-g3mm, and has been assigned a high severity CVSS v3.1 score of 9.4. Affected versions of the UFO Desktop AgentOS include all releases up to and including v3.0.7. Alarmingly, at the time of this disclosure, Microsoft had not released an official patch to remedy the issue, leaving users exposed to potential threats.
Understanding the Vulnerability
The core of the issue lies in how UFO operates its Mobile MCP data-collection and action servers, which inadvertently expose Android Debug Bridge (ADB)-based functionalities over Streamable HTTP. When operators configure these servers as described in the documentation—specifically binding the services to the 0.0.0.0 address—these servers become accessible over TCP ports 8020 and 8021 to any network client with sufficient access privileges.
Port 8020 hosts the mobile data-collection service, which is able to extract sensitive user information such as screenshots, the Android user interface hierarchy, information about installed applications, and various device metadata. Meanwhile, port 8021 runs the mobile action service, which is of even greater concern due to its ability to convert MCP requests into ADB commands capable of executing a range of operations on the connected devices.
Risks and Threats
The advisory details indicate a concerning gap in security measures, as neither of the exposed services mandates an authentication provider or implements request-level authorization checks in the affected version. This lack of protective measures allows unauthorized MCP clients to establish sessions and leverage privileged tools.
Consequently, remote attackers could compromise sensitive data visible on a connected device, including messages, one-time passwords, user credentials, personal data, and application content. The action server poses an even larger integrity risk because it allows attackers to interact with the Android device almost as if they were the legitimate user. Potential actions include tapping screen coordinates, swiping, entering unauthorized text, simulating key presses, launching applications, and clicking on user interface elements.
Importantly, exploitation of this vulnerability does not necessitate an API key, an authenticated UFO session, or any form of user interaction. An attacker merely requires network-level access to an exposed service, significantly lowering the barrier for unauthorized activities.
The implementation flaw within UFO directly translates tool requests into privileged ADB subprocess operations. For instance, a request to utilize the tap tool can lead to executing an ADB shell command that simulates a tap at coordinates specified by the attacker. Similarly, the screenshot function can capture the device’s display, retrieve the resulting image, and convert it into Base64-encoded data for transmission back to the perpetrator.
Immediate Necessary Actions
A proof of concept utilizing a benign replacement for the ADB executable demonstrated that unauthenticated requests for operations such as tapping were accepted and able to reach the simulated ADB command sink successfully.
By default, the UFO server binds to localhost, which somewhat mitigates exposure in environments where the deployment remains unchanged. However, organizations that have enabled remote access to Mobile MCP servers must take urgent measures to restrict access to TCP ports 8020 and 8021, limiting connectivity to trusted networks only and eliminating public exposure.
Additionally, organizations are advised to conduct a thorough review of the connected Android devices for any signs of unauthorized activity or data breaches.
While a proposed remediation feature, which has not yet been merged, suggests implementing a high-entropy bearer token via the UFO_MCP_API_KEY environment variable, it currently lacks functionality as a failsafe. The suggested procedure includes rejecting invalid or absent credentials before any ADB operations take place.
Organizations exposing UFO services should also consider employing secure protocols such as TLS, utilizing authenticated reverse proxies, or establishing trusted private tunnels to further enhance their security measures against this vulnerability.
In a world increasingly reliant on mobile technology, the implications of such vulnerabilities cannot be understated. Precaution is essential to safeguard sensitive information and maintain the integrity of user devices against potential exploitation.