19
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
5.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
14
LOW
1
Monthly CVE Trend
Affected Products (30)
Harmonyos
815
Emui
549
Magic Ui
180
Secospace Usg6600 Firmware
43
Usg9500 Firmware
42
P30 Firmware
38
S5700 Firmware
28
Nip6800 Firmware
27
Mate 20 Firmware
27
P30 Pro Firmware
25
S7700 Firmware
23
P8 Firmware
22
Secospace Usg6300 Firmware
22
S6700 Firmware
21
Secospace Usg6500 Firmware
21
Fusionsphere Openstack
21
Cloudengine 12800 Firmware
21
Fusioncompute
19
S9700 Firmware
19
S9300 Firmware
18
Uma
18
P9 Firmware
18
Mate S Firmware
18
Ar3200 Firmware
17
S12700 Firmware
17
Mate 30 Firmware
16
Cloudengine 6800 Firmware
16
Nip6600 Firmware
16
P10 Plus Firmware
15
Cloudengine 7800 Firmware
15
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49310 | Unauthenticated remote availability disruption in Huawei HarmonyOS 6.1.0 allows network-accessible attackers to exploit missing permission controls in the event notification module, causing high-severity service outages that propagate beyond the vulnerable component via a scope change. The vulnerability is rooted in CWE-264 (Permissions, Privileges, and Access Controls) and carries a CVSS 3.1 base score of 8.6 with no privilege or user-interaction requirements. Huawei issued remediation guidance in its September 2026 security bulletin covering smartphones, Vision devices, wearables, and laptops; no public exploit code has been identified at time of analysis. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2026-49314 | Out-of-bounds write in HarmonyOS 6.1.0's rendering and composition module allows a locally executing process to corrupt adjacent memory, with vendor-stated impact to availability and a CVSS vector also indicating potential confidentiality exposure. Affected devices are those running Huawei HarmonyOS version 6.1.0 as confirmed by EUVD-2026-74596. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis. | HIGH | 7.3 | 0.1% | 37 |
No patch
|
| CVE-2026-49315 | Denial-of-service in Huawei HarmonyOS and EMUI's input device module allows a local unprivileged attacker to crash affected system components, impacting device availability. The CVSS scope change (S:C) indicates the flaw propagates availability impact beyond the vulnerable input module itself, potentially affecting higher-privileged or dependent subsystems. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-49311 | HarmonyOS 6.1.0's event notification module contains a permission control flaw (CWE-275) that allows a locally-executing process without elevated privileges to disrupt the availability of the notification service. Both the CVSS vector (C:N/I:N/A:H) and Huawei's own bulletin text confirm the impact is strictly an availability denial - confidentiality and integrity are unaffected. Huawei has published remediation across four September 2026 bulletin categories covering consumer devices, smart displays, wearables, and laptops, indicating the flaw spans the full HarmonyOS device ecosystem. No public exploit code has been identified at time of analysis. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-49302 | Notification service module in HarmonyOS 6.1.0 exposes sensitive data due to improper permission enforcement, allowing local access to confidential notification content without requiring elevated privileges. Huawei disclosed this flaw in its August 2026 security bulletins, covering smartphones, Vision devices, wearables, and laptops running HarmonyOS 6.1.0. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA KEV. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-49307 | Improper permission control in HarmonyOS 6.1.0's multi-mode input module exposes sensitive service data to local, unprivileged processes. The flaw, rooted in CWE-200 (information exposure), allows a local attacker or malicious application without elevated privileges to read confidential data handled by the input subsystem. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-49301 | The Gallery module in Huawei HarmonyOS (4.0.0-4.3.1) and EMUI (14.0.0-15.0.0) contains a permission control flaw that allows a local process or application without elevated privileges to access protected gallery content, producing high confidentiality impact. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw bypasses scoped media permission enforcement native to the HarmonyOS/EMUI security model. No public exploit has been identified and CISA SSVC confirms no known exploitation at time of analysis. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-49304 | Permission control failure in HarmonyOS 6.1.0's device key management module allows a local, unprivileged actor to cause a complete availability loss on the vulnerable system. The flaw is classified under CWE-264 (Permissions, Privileges, and Access Controls), indicating improper enforcement of access restrictions within the key management subsystem. SSVC assessment confirms no known exploitation and non-automatable attack, but the local-no-privilege vector lowers the bar for any co-located attacker or malicious app on the device. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-49305 | Local availability disruption in Huawei HarmonyOS and EMUI affects the Wi-Fi enhancement module through a permission control flaw rooted in improper handling of exceptional conditions (CWE-755). Huawei HarmonyOS versions 4.0.0 through 4.3.1 and EMUI versions 14.0.0 through 15.0.0 are confirmed affected, allowing a local unprivileged process to crash or deny Wi-Fi service availability without requiring user interaction. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC assessment places exploitation as 'none' with partial technical impact, indicating low urgency but real operational risk for availability-sensitive deployments. | MEDIUM | 6.2 | 0.1% | 31 |
No patch
|
| CVE-2026-81646 | Out-of-bounds read (CWE-125) in the HarmonyOS graphics module affects version 6.1.0 across multiple device categories including smartphones, wearables, and laptops. A local attacker without special privileges can trigger the flaw to cause partial availability loss, limited information disclosure, or a crash of the graphics subsystem. No public exploit code or active exploitation has been identified at time of analysis, and Huawei has released a security bulletin addressing the issue. | MEDIUM | 5.9 | 0.1% | 30 |
No patch
|
| CVE-2026-49308 | Improper permission controls in the HarmonyOS 6.1.0 clipboard module expose confidential data to local attackers. The flaw, classified under CWE-264 (Permissions, Privileges, and Access Controls), allows a local actor who can induce user interaction to read clipboard contents without appropriate authorization, impacting confidentiality only. No active exploitation is confirmed by CISA KEV, and SSVC rates exploitation status as none with no automation potential. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|
| CVE-2026-81647 | Out-of-bounds read via integer overflow in the HarmonyOS graphics module exposes affected devices to a denial-of-service condition. Exploitation targets HarmonyOS 6.1.0 and, per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), requires no authentication or user interaction - suggesting a network-facing graphics processing pathway is reachable without privilege. The sole confirmed impact is availability (A:L), consistent with a crash or partial service disruption in the graphics subsystem; no confidentiality or integrity impact is reported. No public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-49303 | Improper permission enforcement in the notification module of Huawei HarmonyOS and EMUI permits a local, unprivileged process to interfere with notification handling, resulting in limited integrity and availability impact. Affected versions span HarmonyOS 4.0.0 through 4.3.1 and EMUI 14.0.0 through 15.0.0 across Huawei consumer devices. No public exploit code or active exploitation has been identified at time of analysis; Huawei disclosed this via its August 2026 security bulletin. | MEDIUM | 5.1 | 0.1% | 26 |
No patch
|
| CVE-2026-81644 | Denial-of-service in the HarmonyOS preview service module allows a remote, unauthenticated attacker to degrade or crash the preview functionality when a user interacts with a crafted input. Affected versions are limited to HarmonyOS 6.1.0 on Huawei consumer devices. Exploitation yields only a low-severity availability impact; confidentiality and integrity are unaffected. | MEDIUM | 4.3 | 0.1% | 22 |
No patch
|
| CVE-2026-58560 | Null pointer dereference in the HarmonyOS image codec module causes a local denial-of-service condition, degrading availability of affected devices running HarmonyOS 6.1.0. The flaw is triggered locally without requiring elevated privileges, and successful exploitation crashes or hangs the image codec process. No active exploitation has been identified; no public exploit code is known at time of analysis. | MEDIUM | 4.0 | 0.1% | 20 |
No patch
|