What is the CVSS score of CVE-2026-24792?

CVE-2026-24792 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpenHarmony are affected by CVE-2026-24792?

A remote code execution vulnerability in OpenHarmony v6.0 and earlier versions affects authenticated users across distributed device ecosystems including smart devices and IoT endpoints, creating…

How to fix or mitigate CVE-2026-24792?

Within 24 hours: Conduct comprehensive inventory of all OpenHarmony v6.0 and prior deployments across smart devices, wearables, and IoT endpoints; audit which users have authenticated access to these systems. Within 7 days: Implement network segmentation to isolate OpenHarmony systems from critical infrastructure, enforce multi-factor authentication for accounts with pre-installed application management rights, and enable audit logging for all authenticated sessions. Within 30 days: Establish vendor communication protocol to monitor for OpenHarmony v6.1+ patch release and create migration plan; evaluate alternative operating systems for new device procurement; maintain continuous monitoring for exploitation attempts.

OpenHarmony CVE-2026-24792

EUVD-2026-30826 HIGH

Signal Handler Race Condition (CWE-364)

2026-05-19 OpenHarmony

GHSA-mv6m-pvcq-372p

RCE Openharmony

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 03:45 vuln.today

DescriptionCVE.org

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

AnalysisAI

Remote code execution in OpenHarmony v6.0 and prior versions allows authenticated remote attackers to execute arbitrary code within pre-installed applications through a race condition flaw (CWE-364). The CVSS 8.1 score reflects high confidentiality and availability impact but no integrity impact, and no public exploit has been identified at time of analysis. The vulnerability requires low privileges but no user interaction, making it exploitable across OpenHarmony's distributed device ecosystem including smart devices, wearables, and IoT endpoints running the open-source operating system.

Technical ContextAI

OpenHarmony is an open-source distributed operating system developed under the OpenAtom Foundation, designed for smart devices, IoT endpoints, and consumer electronics across multiple form factors. The affected CPE cpe:2.3:a:openharmony:openharmony covers all OpenHarmony releases up to and including v6.0. The root cause is classified as CWE-364 (Signal Handler Race Condition), which arises when a signal handler accesses shared state that can be concurrently modified, creating a window where an attacker can manipulate program flow during the non-atomic handling of asynchronous signals. In the context of pre-installed apps, this likely affects privileged system components or framework services that handle inter-process communication or system signals, enabling unexpected code paths to be triggered during the race window.

RemediationAI

Patch availability is referenced via the OpenHarmony security disclosure at https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md, but a specific fixed version is not stated in the provided data, so consult that advisory for the exact patched release and upgrade affected devices accordingly. As compensating controls until patching is feasible, restrict network exposure of OpenHarmony devices by placing them behind segmented VLANs or firewalls that block untrusted ingress to device service ports, and limit the set of accounts able to authenticate locally or remotely since PR:L exploitation requires at least low-privilege credentials. Where pre-installed apps with network services are not required, disabling those specific services reduces the attack surface, with the trade-off being loss of associated functionality such as remote management or device-to-device interaction.