Microsoft week 41 2026: command injection and certificate validation lead 11 CVEs

The release at a glance

Microsoft's 5–11 October 2026 advisory set covers 11 CVEs across four open-source components: six in UFO, two in Kiota, two in SimpleChat and one in MsQuic. Severity counts are two critical, five high, three medium and one low. None of the 11 CVEs appears in CISA KEV and none is marked as exploited in the advisory data.

The items most likely to matter first are the critical MsQuic certificate validation flaw, a critical authenticated command injection in UFO, and high-severity injection and stored XSS flaws in UFO, Kiota and SimpleChat. The descriptions name versions where the issues are addressed, but the structured CVE records do not mark a patch as available for any of the 11 CVEs.

What matters most

UFO: CVE-2026-105793 is a critical CVSS 9.1 authenticated command injection in the Mobile MCP press_key tool. A caller with a valid UFO_MCP_API_KEY and an authorised connected device can execute commands as the Android shell user. CVE-2026-105788 is an 8.8 command injection in type_text and launch_app with the same authenticated device constraint; affected releases are before 3.0.10. CVE-2026-105791 is a 7.5 Windows run_shell flaw that can launch an arbitrary executable or script as the desktop user if an agent workflow is induced; affected releases are before 3.0.9.

MsQuic: CVE-2026-105794 is the other critical (CVSS 9.1). Clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target hostname, so an on-path attacker can spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. Affected releases are before 2.4.20, 2.5.0 up to before 2.5.11, and 2.6.0 up to before 2.6.1.

SimpleChat: CVE-2026-105797 is an 8.8 authorisation-gate ordering flaw that can let an authenticated low-privileged user start an attacker-selected operating-system process through the MCP stdio transport when personal plugins and MCP actions are enabled; affected releases are before 0.261.031. CVE-2026-105798 is an 8.7 stored XSS through a group document filename that executes when another group member clicks Share; affected releases are before 0.261.029.

Kiota: CVE-2026-105796 is an 8.8 code injection in the Java and PHP documentation-comment sanitizers. A malicious OpenAPI description can lead to injected code when the generated output is compiled or loaded; affected releases are 0.5.0 up to before 1.35.0, including Microsoft.OpenApi.Kiota and Microsoft.OpenApi.Kiota.Builder.

The remaining UFO items are medium severity: a deadlock (CVE-2026-105792), a WebSocket SSRF redirect (CVE-2026-105790) and an arbitrary file write (CVE-2026-105789). The remaining Kiota item is a low-severity unsafe manifest reference (CVE-2026-105795). They are listed in the table.

Patch in this order

1. Start with MsQuic if you use the OpenSSL or QuicTLS backend. The flaw is network-reachable without authentication and allows an on-path attacker to impersonate a server. The advisory names 2.4.20, 2.5.11 and 2.6.1; confirm those releases are available in your distribution before applying. Schannel deployments are not affected.

1. Prioritise UFO deployments next, especially those with Mobile MCP enabled or Windows agent workflows. The advisory names 3.0.9 for several UFO flaws and 3.0.10 for CVE-2026-105788; the structured CVE records do not mark a patch as available, so verify release status before attempting deployment. The highest-score items require a valid Mobile MCP API key and an authorised device, but can still execute commands on connected devices or, in the Windows case, as the desktop user.

1. Treat Kiota code generation as a build-time risk. The high-severity issue affects releases before 1.35.0, and the advisory names 1.35.0. Teams generating client code from third-party OpenAPI descriptions should validate the description source and check for an available update before the next build.

1. Address SimpleChat, particularly if personal plugins and MCP actions are enabled, because the command injection can start an operating-system process. The advisory names 0.261.031 for the command injection and 0.261.029 for the stored XSS. Confirm availability, then deploy to close both flaws.

1. Review the remaining medium and low UFO and Kiota issues in the table after the higher-priority items are handled.

Beyond the patch

Treat these open-source components like any other internet-facing or build-time dependency next month: maintain an inventory of versions, map which paths reach the affected tools, and watch for the process-spawning and unauthorised shell activity that the higher-severity flaws would produce. Implementation & Assessment Services is the fit for the injection, authentication and certificate-validation logic across UFO, SimpleChat, MsQuic and Kiota; Managed Detection & Response provides the detection layer for the process spawning, unauthorised Android shell commands and post-exploitation activity that would follow misuse.