CVE-2026-73296 microsoft CVE debrief

Who should care

Defenders responsible for Microsoft UFO deployments, particularly those with ADB-connected Android devices, should assess exposure and apply the patch. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-73296 allows unauthenticated remote attackers to interact with ADB-connected Android devices, potentially disclosing sensitive data and modifying device state. Defenders should verify exposure and apply the patch.

• Unauthenticated remote attackers can invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control actions against ADB-connected Android devices.
• Screen and device data can be disclosed.
• Device state can be modified by attackers.

Technical summary

The Microsoft UFO open-source framework for intelligent automation across devices and platforms has a vulnerability prior to version 3.0.8. The create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state.

Defensive priority

Defenders should prioritize verifying exposure of Microsoft UFO versions prior to 3.0.8 and applying the patch in version 3.0.8.

Recommended defensive actions

• Verify exposure of Microsoft UFO versions prior to 3.0.8
• Apply the patch in version 3.0.8
• Inventory and assess ADB-connected Android devices for potential exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Microsoft UFO prior to version 3.0.8, which allows unauthenticated remote attackers to invoke certain actions against an ADB-connected Android device. The vulnerability is fixed in version 3.0.8. Official CVE Program record with source-provided CVE metadata and Official NIST NVD detail page and source-specific vulnerability assessment provide additional information. Source references also provide details on the vulnerability fix and patched version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.