PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108506 ZTE CVE debrief

ZTE Z80 Ultra's system interfaces lack robust invocation authentication, allowing third-party apps to call interfaces through reflection and retrieve relevant information. This unauthorized access vulnerability has a CVSS score of 5.5 and is considered medium severity. The vulnerability affects ZTE Z80 Ultra products and has been publicly disclosed. Defenders should assess exposure and prioritize verification of the affected version. The CVE Program record and NVD vulnerability detail provide official information about the vulnerability.

Vendor
ZTE
Product
Z80 Ultra
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Defenders responsible for ZTE Z80 Ultra products should assess exposure and prioritize verification of the affected version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the affected version, GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions, and assess exposure in their environment.

Why it matters

This unauthorized access vulnerability in ZTE Z80 Ultra's system interfaces has a medium severity CVSS score of 5.5. Defenders should prioritize verifying the affected version, assessing exposure, and implementing robust authentication to prevent unauthorized access.

  • Verify affected versions to determine exposure
  • Implement robust authentication to prevent unauthorized access
  • Monitor for potential unauthorized access attempts

Technical summary

The ZTE Z80 Ultra product has an unauthorized access vulnerability due to inadequate access control and lack of robust invocation authentication in its system interfaces. This allows third-party apps to call interfaces through reflection and retrieve relevant information.

Defensive priority

Defenders should prioritize verifying the affected version, GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions, and assessing exposure in their environment.

Recommended defensive actions

  • Verify the affected version of ZTE Z80 Ultra and assess exposure in the environment
  • Implement robust authentication for system interfaces
  • Monitor for potential unauthorized access attempts

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item and supplemental source reference offer additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108506 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108506

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108506 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108506

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Unauthorized access vulnerability in ZTE Z80 Ultra product

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108506.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281253

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.