NT OneAPP CVE-2026-114222

Exploitation requires local access to a device that already has an authenticated/logged-in NT OneAPP session protected only by the App PIN lock, after which a specially crafted Deep Link is used to bypass that PIN lock and reach protected resources. The key limiting factors are: (1) physical or local access to the target device is mandatory (AV:L) - this is not remotely exploitable; and (2) the victim must already be logged in, so the flaw defeats the at-rest PIN barrier rather than full account authentication. No special non-default configuration is indicated; the PIN lock is the feature being circumvented.

This is a moderate, not high-priority, issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 6.9 and tells a consistent story with the description: exploitation requires LOCAL access (AV:L) to a device where a user is already logged in, but no authentication (PR:N) or user interaction (UI:N) is then needed to bypass the App PIN lock. Impact is confidentiality-only (VC:H, VI:N, VA:N) - the attacker reads protected resources but cannot modify or deny them. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the AV:L requirement: an attacker needs physical possession of (or local access to) an unlocked-but-PIN-protected device, which makes this a targeted/opportunistic device-theft scenario rather than a remotely scalable threat. This is a real defect worth patching for a mobile-security-conscious user base, but it is not an urgent internet-facing emergency.

An attacker who gains physical possession of a victim's device (e.g., a lost, stolen, or briefly unattended phone) where the user remains logged into NT OneAPP invokes a crafted Deep Link that bypasses the App PIN lock screen. This grants direct access to the logged-in user's protected resources without knowing the PIN. No public proof-of-concept was provided in the input.