This vulnerability (CVE-2026-40001) affects the ZTE PROCESS Guard service in the ZXCLOUD-iRAI-ClientV7.2X product. It is classified under CWE-269 (Improper Privilege Management) and allows a local attacker to escalate privileges, execute arbitrary code, and bypass path traversal restrictions. The CVSS 3.1 base score is 5.2, reflecting a medium severity with local attack vector, low attack complexity, and no user interaction required. The vulnerability is published but lacks an official remediation or patch from ZTE as of the current data.

Successful exploitation can lead to local arbitrary code execution with elevated privileges and bypass of path traversal protections. This can compromise system integrity and availability on affected client installations. However, the impact is limited to local attackers with access to the system, and no remote exploitation vector is indicated. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious local activity related to the ZTE PROCESS Guard service. Avoid deploying affected versions in sensitive environments if possible.