CVE-2026-41964: Huawei HarmonyOS Vulnerability
High CVSS (8.4) vulnerability; prioritize internet-facing assets.
TL;DR - CVE-2026-41964 is a high-severity Huawei HarmonyOS web permission-control vulnerability with an NVD CVSS score of 8.4. - HarmonyOS 6.1.0 and 6.0.0 are identified as affected. Huawei has not specified a fixed build in the retrieved advisories. - No verified public proof of concept or active exploitation is known, and CISA KEV does not list the CVE. - Identify affected devices and apply the latest Huawei security update available for each model and region.
Summary
CVE-2026-41964 is a Huawei HarmonyOS vulnerability affecting phones, tablets, and PCs running HarmonyOS 6.1.0 or 6.0.0. NVD and Huawei describe the issue as a web permission-control vulnerability that may affect availability when successfully exploited.
Organizations should begin with version-based asset inventory, then verify device-specific security updates. The retrieved Huawei advisories do not identify a fixed build, individual affected models, or detailed exploitation requirements.
For broader device-hardening context, review how to secure IoT devices on your network.
| Field | Detail |
|---|---|
| CVE | CVE-2026-41964 |
| CVSS | 8.4, according to NVD |
| CVSS vector | Not included in the retrieved NVD record |
| Vulnerability type | Web permission-control vulnerability |
| Potential impact | Availability |
| Affected versions | HarmonyOS 6.1.0 and HarmonyOS 6.0.0 |
| Fixed version | Not specified in the retrieved Huawei advisories |
| CISA KEV | No; on_kev: false |
| Published | 15 May 2026 |
| Last modified | 26 October 2026 |
The missing CVSS vector matters operationally. The score alone does not establish whether exploitation is remote, whether authentication is required, whether user interaction is necessary, or whether the vulnerable component is network reachable. Defenders should not assign a precise attack path based only on the 8.4 score.
Analyst’s Take: Treat the 8.4 score as a reason to move quickly, not as an explanation of the attack path. The missing CVSS vector and undisclosed web component leave important exposure questions unanswered, while version-based inventory and device-specific update checks are actionable now.
Root Cause
The disclosed root cause is a failure in permission control affecting Huawei web functionality. Available vendor and NVD material does not identify the specific web service, module, API, authorization boundary, or permission-checking logic involved. It also does not provide a patch diff, technical advisory, or detailed exploitation preconditions.
The safest technical interpretation is that a web-related operation can be authorized or executed incorrectly under conditions that have not been publicly described. Huawei states that successful exploitation may affect availability.
The available material does not establish compromise of confidentiality or integrity. It also does not show whether the issue enables arbitrary code execution, privilege escalation, data access, or persistent control.
Administrators should treat this as an availability-focused vulnerability while preserving uncertainty around exploitability. Do not assume that the issue is internet-exploitable, local-only, authenticated, or unauthenticated until Huawei publishes a CVSS vector or additional technical details.
Who Is Exposed?
Huawei identifies HarmonyOS 6.1.0 and HarmonyOS 6.0.0 as affected versions. The issue appears in both May 2026 bulletins:
- Security Bulletins for HUAWEI Phones/Tablets, May 2026
- Security Bulletins for HUAWEI PCs, May 2026
The retrieved advisories do not enumerate individual phone, tablet, or PC models. An absent model in an internal product list therefore does not establish that the model is safe. The reliable exposure criterion currently available is the installed HarmonyOS version, combined with Huawei’s device-specific applicability guidance.
Affected Versions
| Product family | Affected version |
|---|---|
| Huawei phones and tablets using HarmonyOS | 6.1.0 |
| Huawei PCs using HarmonyOS | 6.1.0 |
| Huawei phones and tablets using HarmonyOS | 6.0.0 |
| Huawei PCs using HarmonyOS | 6.0.0 |
A fixed version is not specified in the retrieved Huawei material. Security teams should not record a particular release as confirmed safe unless Huawei’s device update channel or a later advisory explicitly identifies it as resolving CVE-2026-41964.
Devices running versions other than 6.1.0 or 6.0.0 should still be checked against current Huawei guidance because the available record may not describe every supported branch or backport.
Severity Breakdown
NVD assigns CVE-2026-41964 a base score of 8.4, placing it in the High severity range. Huawei also classifies the issue as High. The disclosed impact is that successful exploitation may affect availability, which could include disruption of a web-related service or device functionality.
The public descriptions do not define the precise failure mode.
| CVSS component | Available assessment |
|---|---|
| Attack Vector | Unknown |
| Attack Complexity | Unknown |
| Attack Requirements | Unknown from the available record |
| Privileges Required | Unknown |
| User Interaction | Unknown |
| Scope | Unknown |
| Confidentiality | Not established by the available description |
| Integrity | Not established by the available description |
| Availability | Potentially affected, according to NVD and Huawei |
This uncertainty affects prioritization. An 8.4 score warrants prompt remediation, but it cannot answer whether an attacker must already have local access, whether a logged-in user is required, or whether an exposed web interface can be reached remotely.
Until the vector is published, prioritize managed devices in sensitive environments, devices with reachable web functionality, and devices that cannot be quickly isolated or updated.
Exploitation Status
CVE-2026-41964 is not listed in the CISA Known Exploited Vulnerabilities catalog based on the information used for this article. Its recorded status is on_kev: false; there is no CISA due date, required action, or ransomware campaign designation associated with the CVE.
No verified public proof-of-concept repository or exploit was identified in the retrieved research. No reliable primary-source confirmation of exploitation in the wild was identified either.
Current status:
- CISA-confirmed exploitation: No
- Known public PoC: No verified PoC identified
- Confirmed in-the-wild exploitation: No reliable confirmation identified
- Exploit maturity: Not established
The absence of a KEV entry or public PoC is not evidence that exploitation is impossible. It means that the available sources do not establish active exploitation.
Huawei credits Hongze Wu and Shuaike Dong of the Ant Group Infrastructure Security Team. This confirms vulnerability research or disclosure credit but does not indicate that an exploit was released.
Sources
-
NVD, CVE-2026-41964
https://nvd.nist.gov/vuln/detail/CVE-2026-41964 -
Huawei Security Bulletins for HUAWEI Phones/Tablets, May 2026
https://consumer.huawei.com/en/support/bulletin/2026/5/ -
Huawei Security Bulletins for HUAWEI PCs, May 2026
https://consumer.huawei.com/en/support/bulletinlaptops/2026/5/ -
Huawei Vulnerability Acknowledgment
https://consumer.huawei.com/en/support/acknowledgment -
CISA Known Exploited Vulnerabilities Catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
The source record supports a high-severity classification, affected HarmonyOS versions 6.1.0 and 6.0.0, and a potential availability impact. It does not support a specific fixed version, detailed CVSS component breakdown, confirmed public exploit, or confirmed in-the-wild exploitation.
Defenders should identify affected Huawei devices, verify updates through the applicable official channel, and continue monitoring Huawei and CISA publications for changes.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should begin with asset inventory rather than exploit hunting. Identify Huawei phones, tablets, and PCs that report HarmonyOS 6.1.0 or 6.0.0.
Where mobile-device management or endpoint inventory cannot expose the OS build, require users or administrators to provide the version from the device’s system information page. Record the exact build for update validation.
Because the vulnerable web component and request pattern are undisclosed, there is no defensible CVE-specific network signature available from the retrieved sources. Security teams should not create a high-confidence IDS rule based on generic HTTP traffic.
Instead, monitor for:
- Unexpected availability failures
- Service restarts
- Device reboots
- Web-interface errors
- Repeated web-service crashes
- Suspicious access attempts correlated with affected device versions
A useful first step is to compare this vulnerability with broader EDR capabilities and terminology when determining whether endpoint telemetry can expose affected devices and related symptoms.
Technical Notes
Use the following conceptual inventory query in an MDM or asset platform, adapting field names to the product in use:
device.vendor = "Huawei"
AND device.os_family = "HarmonyOS"
AND device.os_version IN ("6.1.0", "6.0.0")
For centralized logs, search for repeated availability symptoms around web-service activity. The exact event names vary by Huawei platform and logging configuration, so the following pattern is a starting point rather than a vendor-confirmed signature:
(host.vendor="Huawei" OR device.os_family="HarmonyOS")
AND (
message CONTAINS "web"
OR message CONTAINS "HTTP"
OR message CONTAINS "service restart"
OR message CONTAINS "crash"
OR message CONTAINS "unavailable"
)
AND timestamp >= now()-24h
Investigate clusters of web-service errors, unexpected restarts, or availability loss on devices running affected versions. A matching log message does not prove exploitation. Confirm the device version, determine whether the event is reproducible or recurring, preserve relevant logs, and escalate suspicious activity through Huawei support or the organization’s incident-response process.
Remediation Steps
Huawei’s May 2026 bulletins identify HarmonyOS 6.1.0 and 6.0.0 as affected, but the retrieved advisory content does not specify a fixed HarmonyOS version, build number, patch identifier, or CVE-specific changelog entry.
Accordingly, there is no defensible command such as upgrade-to-version-X that can be provided without inventing a fixed release.
Apply the latest security update offered for each affected device or platform. Then verify that the installed build is newer than the vulnerable build and is identified by Huawei as containing the relevant May 2026 security fixes.
If the update channel offers no applicable update:
- Document the affected device and exact build.
- Contact Huawei support.
- Restrict unnecessary exposure.
- Monitor for a fixed build or additional Huawei guidance.
- Reassess the device before returning it to normal network access.
Phones and Tablets
For phones and tablets, use the device’s built-in system update workflow:
- Open Settings.
- Navigate to the device software or system update section.
- Check for updates.
- Install the latest Huawei security release offered for that model and region.
- Record the resulting HarmonyOS version and full build number.
Huawei PCs
For Huawei PCs, use the supported Huawei PC update mechanism and verify the resulting HarmonyOS build in system information.
Because the retrieved advisory does not provide a fixed version, validation must compare the installed build with Huawei’s current device-specific bulletin or support guidance.
A practical administrative change record should include:
CVE: CVE-2026-41964
Previous version: 6.0.0 or 6.1.0
Previous build: <record exact build>
Update source: Huawei device/platform update channel
New version: <record exact version>
New build: <record exact build>
Huawei advisory confirmation: <URL or support reference>
Validation date: <UTC timestamp>
Temporary Mitigations
If immediate updating is impossible, apply temporary controls appropriate to the environment:
- Remove unnecessary exposure of Huawei web interfaces from untrusted networks.
- Restrict management access to approved administrative networks or VPN paths.
- Disable optional web functionality where Huawei documents that it can be safely disabled.
- Separate affected devices from sensitive internal systems where practical.
- Monitor for availability failures and suspicious web access.
- Recheck Huawei advisories regularly for a fixed build or more detailed workaround.
These controls are compensating measures, not a substitute for the vendor update. Do not claim remediation solely because the device is not listed in CISA KEV; KEV status tracks confirmed exploitation, not patch state.