PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24792 OpenHarmony CVE debrief

A high-severity vulnerability in OpenHarmony v6.0 and prior versions allows remote attackers to execute arbitrary code in pre-installed applications. The vulnerability, published on May 19, 2026, carries a CVSS 3.1 score of 8.1 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. The attack requires low privileges and no user interaction, with network-based exploitation possible. The underlying weakness is categorized as CWE-364. The NVD currently lists this CVE with a status of 'Deferred'. OpenHarmony has disclosed this issue through their security disclosure process.

Vendor
OpenHarmony
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations deploying OpenHarmony-based devices, IoT security teams, mobile device management administrators, and supply chain security assessors evaluating embedded operating systems.

Technical summary

CVE-2026-24792 affects OpenHarmony v6.0 and earlier, enabling remote attackers with low privileges to execute arbitrary code within pre-installed applications without user interaction. The vulnerability has high impact on confidentiality and availability per CVSS scoring. The root cause relates to weakness CWE-364. As of publication, NVD has deferred analysis of this entry. OpenHarmony's security disclosure process has documented this issue in their 2026-04 security bulletin.

Defensive priority

HIGH

Recommended defensive actions

  • Review OpenHarmony security disclosure 2026-04 for patch availability and affected component details
  • Assess pre-installed application inventory on OpenHarmony v6.0 and prior deployments
  • Apply security updates from OpenHarmony project when available
  • Monitor NVD for status change from Deferred to Analyzed
  • Implement network segmentation to limit exposure of OpenHarmony devices to untrusted networks

Evidence notes

CVE published 2026-05-19T04:16:27.907Z; modified 2026-05-19T14:25:04.340Z. CVSS 8.1 HIGH. NVD status: Deferred. Weakness: CWE-364. Vendor evidence points to OpenHarmony via Gitcode security disclosure reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24792 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24792

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24792 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24792

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.