CVE-2026-62316highCWE-200CWE-346

CVE-2026-62316: falha de alta gravidade em microsoft UFO

Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar UFO

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
microsoft · UFO
CVEs relacionadas — microsoft UFO

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73296CRITICALMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosureEPSS 3.7%CVE-2026-73297MEDIUMMicrosoft UFO: IPv6 transition address bypass of SSRF guard in URL validationEPSS 2.9%CVE-2026-45322HIGHOS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSONEPSS 2.4%CVE-2026-105788HIGHMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_appEPSS 1.1%CVE-2026-105793CRITICALMicrosoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`EPSS 0.9%CVE-2026-46402HIGHMicrosoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directoryEPSS 0.7%