TLDR Tech / InfoSec
Critical Microsoft UFO MCP Flaw Lets Attackers Remotely Control Android Devices Without Authentication
Unauthenticated attackers can drive ADB commands on Android devices connected to Microsoft's open-source UFO Desktop AgentOS through CVE-2026-73296, which affects versions up to v3.0.7 and has no official patch. Attackers can exploit this vulnerability to capture screenshots, extract UI hierarchy data, and tap, swipe, and text-entry actions on TCP 8020 and 8021 whenever operators follow the documented remote-deployment guidance and bind to 0.0.0.0. Users should restrict those ports to trusted hosts and front the services with TLS and an authenticated reverse proxy until the proposed UFO_MCP_API_KEY bearer-token fix merges.
Read the full story