CVE-2026-28553
Published: 13 April 2026
Summary
CVE-2026-28553 is a medium-severity an unspecified weakness vulnerability in Huawei Harmonyos. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources like the theme setting module, directly addressing the improper permission control vulnerability.
Employs least privilege to restrict access to the theme setting module, preventing local attackers from compromising service confidentiality.
Identifies and remediates flaws like CVE-2026-28553 through timely application of vendor patches from the Huawei support bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper permission control (CWE-275) in a local theme module with scope change and high confidentiality impact directly enables exploitation for privilege escalation (T1068) and unauthorized collection of data from the local system (T1005).
NVD Description
Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Deeper analysisAI
CVE-2026-28553 is a vulnerability involving improper permission control in the theme setting module, associated with CWE-275. It affects Huawei consumer products, as indicated by the vendor's support bulletin. Published on 2026-04-13, the issue carries a CVSS v3.1 base score of 6.9 (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L), highlighting a medium-severity risk primarily to confidentiality.
Exploitation requires local access, high attack complexity, no privileges, and user interaction. A local attacker could leverage this to achieve high confidentiality impact, along with low integrity and availability impacts, due to the changed scope. Successful exploitation may compromise service confidentiality.
Huawei has issued a support bulletin at https://consumer.huawei.com/en/support/bulletin/2026/4/, which provides details on the vulnerability and likely includes mitigation guidance or patches for affected products.
Details
- CWE(s)