Cyber Resilience

CVE-2026-40004

Medium

Published: 07 May 2026

Published
07 May 2026
Modified
13 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.5 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
EPSS Score 0.0014 3.5th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-40004 is a medium-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Zte Zxcloud Irai. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability details

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.

CWE(s)
CWE-427

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1574.001 DLL Stealth
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.
attack.mitre.org →
Why these techniques?

CWE-427 uncontrolled search path enables local DLL/config hijacking for arbitrary code exec and priv esc (T1574.002); directly maps to exploitation for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

zte
zxcloud irai
7.23.20 — 7.25.43

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References