What happened
NVD published CVE-2026-73296 (CVSS 9.4, Critical) on 2026-08-12, describing missing authentication on UFO's mobile-device-control MCP servers, allowing any network-reachable attacker to remotely operate an ADB-connected Android device through the exposed agent tool interface.
Why it matters
This is a textbook agentic-tool-surface vulnerability: an MCP server meant to let an AI agent control a mobile device is exposed with zero authentication, letting any attacker on the network hijack full device control (screenshots, taps, app launches) through the same interface the AI agent uses — a novel agent-execution attack class with a working, well-documented exploitation path.
Attack vector
create_mobile_data_collection_server and create_mobile_action_server expose Streamable HTTP MCP services on TCP ports 8020/8021 without authentication, letting an unauthenticated remote attacker invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device — full remote control and data disclosure of the device.
Affected systems
Microsoft UFO framework prior to 3.0.8
Mitigation
Upgrade to UFO >= 3.0.8; restrict network exposure of MCP ports 8020/8021; require authentication on MCP tool endpoints.