CVE-2026-28536
Published: 05 March 2026
Summary
CVE-2026-28536 is a critical-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Huawei Harmonyos. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 8.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-3 (Device Identification and Authentication) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-28536 is an authentication bypass vulnerability in the device authentication module affecting Huawei consumer devices. Published on 2026-03-05T07:16:13.660, it carries a CVSS v3.1 base score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-305. Successful exploitation impacts integrity and confidentiality.
The vulnerability can be exploited by unauthenticated attackers on an adjacent network, requiring low complexity and no user interaction. Exploitation allows attackers to bypass authentication, resulting in high impacts to confidentiality, integrity, and availability with a changed scope.
Huawei has published security bulletins addressing this issue, available at https://consumer.huawei.com/en/support/bulletin/2026/3/, https://consumer.huawei.com/en/support/bulletinlaptops/2026/3/, and https://consumer.huawei.com/en/support/bulletinvision/2026/3/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9795
Vulnerability details
Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass in device auth module on adjacent network enables exploitation of exposed remote services (T1133/T1210) for unauthenticated initial access with full C/I/A impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces robust device identification and authentication mechanisms to prevent bypass vulnerabilities in the device authentication module.
Mandates timely identification, reporting, and correction of system flaws like this CVE through vendor patches.
Restricts permitted actions without identification or authentication, limiting potential exploitation impact from bypass.