CVE-2026-105793

Executive Summary

CVE-2026-105793 is a critical OS command injection vulnerability (CWE-78) in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. Prior to version 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to adb shell input keyevent, allowing an authenticated Mobile MCP caller to inject and execute additional shell commands on an authorized connected Android device as the Android shell user. With a CVSS score of 9.1, this vulnerability poses a severe risk to organizations using UFO for mobile device automation, particularly those exposing the MCP HTTP server in shared or less-trusted network environments.

Technical Analysis

The vulnerability resides in the Mobile MCP HTTP server component of Microsoft UFO (ufo/client/mcp/http_servers/mobile_mcp_server.py). The press_key tool is designed to simulate key events on a connected Android device via the Android Debug Bridge (ADB). It accepts a free-form key_code parameter intended to represent a single Android keyevent code.

The flaw is a classic command injection (CWE-78) arising from unsafe argument handling. The key_code value is passed directly into an adb shell input keyevent invocation. Critically, the adb client concatenates its arguments into a single remote command string that is then reparsed by the Android shell on the device. Because the key_code parameter is not validated, sanitized, or constrained to a numeric keyevent value, an attacker can supply shell metacharacters (e.g., ;, |, &&, backticks, or $()) to break out of the intended input keyevent command and append arbitrary additional commands. These commands are executed by the Android shell user on the connected device.

The attack surface is the HTTP endpoint exposed by the Mobile MCP server. Exploitation requires: (1) a valid UFO_MCP_API_KEY for authentication, (2) adb present on the host running UFO, and (3) a reachable, authorized Android device connected to that host. The scope change (S:C) in the CVSS vector reflects that the injected commands execute in the context of the Android device's shell user — a security authority distinct from the UFO MCP server process itself. The impact is bounded: the vulnerability does not yield host operating-system execution, Android root privileges, or access beyond the Android shell-user context.

Source-level remediation in 3.0.9 presumably constrains the key_code input to a safe, validated form (e.g., numeric keyevent codes) before it is passed to adb, eliminating the injection primitive. No public proof-of-concept or exploit code is currently available.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (OS command injection) and the explicit technical details in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an exposed Microsoft UFO Mobile MCP HTTP server (pre-3.0.9) that is reachable over the network and backed by a host with adb installed and an authorized Android device attached. The server's HTTP interface and the press_key tool endpoint are enumerated.

2. Authentication. The attacker supplies a valid UFO_MCP_API_KEY to satisfy the authenticated-caller requirement. This implies the attacker either holds legitimate credentials or has obtained a key through prior compromise or misconfiguration.

3. Triggering the flaw. The attacker invokes the press_key tool and supplies a crafted key_code value containing shell metacharacters, rather than a plain keyevent code. Because the parameter is free-form and passed unsanitized into the adb shell input keyevent command, the adb client folds the attacker's input into the remote command string that the Android shell reparses.

4. Payload execution. The injected metacharacters terminate the intended input keyevent command and append arbitrary additional shell commands. These execute as the Android shell user on the authorized connected device — not on the UFO host OS and not as Android root. Typical outcomes include reading or modifying app-accessible data on the device, exfiltrating device-resident information, or pivoting to other resources reachable from the device's shell context.

5. Post-exploitation impact. Execution is confined to Android shell-user privileges on a single authorized device. The integrity impact is rated High (I:H), reflecting the ability to alter device state and run commands, while confidentiality and availability impacts are rated Low (C:L, A:L), consistent with the bounded privilege context.

Impact Assessment

The CVSS v3.1 base score is 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L.

• Attack Vector (Network): The MCP HTTP server is network-reachable, so exploitation can occur remotely.
• Attack Complexity (Low): No special conditions beyond the stated prerequisites are needed to inject shell metacharacters.
• Privileges Required (Low): The attacker must possess a valid UFO_MCP_API_KEY.
• User Interaction (None): No victim action is required.
• Scope (Changed): Injected commands execute in the Android device's shell-user security context, separate from the UFO server process.
• Confidentiality (Low) / Integrity (High) / Availability (Low): The attacker can strongly influence device state (integrity) but operates within the constrained Android shell-user context.

The blast radius is limited to the specific authorized Android device connected to the affected UFO host. Because the vulnerability does not escalate to host OS execution or Android root, the primary business risk is unauthorized command execution and data manipulation on managed mobile devices used in automation workflows — particularly concerning for organizations processing sensitive data on such devices or exposing the MCP server broadly.

Detection Guidance

Sigma Rule

title: Potential Command Injection via Microsoft UFO press_key key_code Parameter
id: 5b6a9c2e-3f1d-4a7b-9c8e-1d2f3a4b5c6d
status: experimental
description: Detects suspicious shell metacharacters being passed to adb input keyevent, consistent with CVE-2026-105793 command injection in Microsoft UFO Mobile MCP server.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105793
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-105793
logsource:
  category: process_creation
  product: linux
detection:
  selection_adb:
    Image|endswith:
      - '/adb'
  selection_keyevent:
    CommandLine|contains: 'shell input keyevent'
  selection_meta:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
  condition: selection_adb and selection_keyevent and selection_meta
falsepositives:
  - Legitimate automation that includes unusual key event strings (unlikely)
level: high

YARA Rule

rule CVE_2026_105793_UFO_PressKey_Injection
{
    meta:
        description = "Detects f-string/concatenation construction of adb shell input keyevent command with unsanitized key_code in Microsoft UFO Mobile MCP server source"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105793"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $f1 = "press_key"
        $f2 = "key_code"
        $f3 = "input keyevent"
        $f4 = "mobile_mcp_server"
        $f5 = "adb shell"
    condition:
        filesize < 2MB and
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105793 Microsoft UFO press_key Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"press_key"; http.request_body; content:"key_code"; http.request_body; pcre:"/key_code[^&]*(;|\||`|\$\(|&&)/Ri"; metadata:cve CVE-2026-105793; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105793; classtype:web-application-attack; sid:2026105793; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "adb" and
  process.args : "*input keyevent*" and
  (process.args : "*;*" or process.args : "*&&*" or process.args : "*|*" or process.args : "*`*" or process.args : "*$(*")

Splunk SPL Query

index=* (Image="*adb" OR process_name="adb") CommandLine="*input keyevent*"
| regex CommandLine="(;|&&|\|\||`|\$\()"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, CommandLine
| where count >= 1
| sort - last_seen

Wazuh OSSEC Rule

<group name="web,cve-2026-105793,">
  <rule id="2026105" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.url">press_key</field>
    <field name="http.request_body">key_code</field>
    <regex type="pcre2">(?i)key_code[^&amp;]*(;|\||`|\$\(|&amp;&amp;)</regex>
    <description>CVE-2026-105793: Possible Microsoft UFO press_key command injection attempt via MCP HTTP server.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105793,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the UFO Mobile MCP HTTP server to trusted hosts or an internal management network; do not expose it to untrusted networks.
   • Enforce strong, unique UFO_MCP_API_KEY values, rotate them regularly, and monitor for unauthorized use.
   • Limit the number of adb-authorized devices and the privileges of the Android shell user on connected devices to reduce the impact of injected commands.
   • Where feasible, disable or restrict the press_key tool until the affected code path is validated, and monitor MCP request bodies for shell metacharacters.

2. Patch / upgrade steps.

   • Upgrade to Microsoft UFO 3.0.9 or later, which the NVD description states fixes this issue.
   • Validate the upgrade in a staging environment with a representative connected Android device and confirm that key_code input is constrained to safe values.
   • After upgrading, re-test the press_key tool to verify that shell metacharacters no longer propagate to the Android shell.

3. Long-term hardening.

   • Implement strict input validation for all MCP tool parameters — constrain key_code to an allowlist of valid numeric Android keyevent codes.
   • Avoid constructing shell command strings from user-controlled input; use argument-vector APIs that do not invoke a remote shell.
   • Apply least-privilege principles to the UFO service account and the Android shell context.
   • Enable centralized logging and the detection rules above to catch injection attempts.

References

• NVD — CVE-2026-105793: https://nvd.nist.gov/vuln/detail/CVE-2026-105793
• Microsoft UFO project (GitHub): https://github.com/microsoft/UFO
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105793 is NOT currently listed)

No public proof-of-concept, exploit code, Nuclei template, or known threat actor campaign associated with CVE-2026-105793 has been observed at the time of writing. The CVE is not listed in CISA KEV, and FIRST.org has not yet assigned an EPSS score.