ZTE Z80 Ultra CVE-2026-108501

Exploitation requires code execution on the device itself - specifically a local app able to use reflection to call the affected system interface, which lacks the access-control check that should gate it. Limiting factors: the victim must install/run the attacker-controlled app (UI:R in the vendor vector), the issue is confined to the ZTE Z80 Ultra model, and impact is read-only information disclosure (C:H, I:N, A:N) with no integrity or availability effect. Note the description implies local on-device access even though the vendor vector lists AV:A (adjacent).

This is a moderate-severity information-disclosure issue (CVSS 5.7) in the ZTE Z80 Ultra (nubia Z80 Ultra) smartphone, where a system interface lacks access control and can be reflectively invoked to read otherwise-protected information. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates confidentiality-only impact with no integrity or availability effect, which tempers the CWE-269/'Privilege Escalation' framing - in practice this reads as unauthorized data read rather than full privilege takeover. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. A key conflict must be flagged: the CVSS attack vector is AV:A (adjacent network), but the description ('reflectively invoking the interface') strongly implies a local, on-device malicious app rather than a network-adjacent attacker - verify the true vector with ZTE before treating this as remotely reachable. Overall this is a real but low-to-moderate priority fix: confidentiality-only, device-specific, and lacking any exploitation signal.

A malicious or over-privileged application installed on a ZTE Z80 Ultra uses Java/Android reflection to directly invoke an exported system interface that fails to enforce access control, reading sensitive information it should not be able to access. No public exploit code is identified at time of analysis, and the attack requires the victim to have installed the hostile app (user interaction), limiting opportunistic abuse.