CVE-2026-70386: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in OnePlus OxygenOS

This vulnerability (CVE-2026-70386) in OnePlus OxygenOS arises from an exposed dangerous method or function, which could allow an attacker with high privileges and local access to misuse the function, potentially leading to unauthorized actions due to improper authorization (CWE-863). The affected versions are OxygenOS 15.0.0 versions before 15.0.0.2000, 16.0.0 versions before 16.0.5.1200, and 16.1.0 versions before 16.1.10.500. The CVSS 4.0 vector indicates local attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned by ENISA. No vendor advisory or patch information is available, and no known exploits have been reported.

The vulnerability allows a local attacker with high privileges to exploit an exposed dangerous method or function, potentially leading to unauthorized actions due to improper authorization controls. The impact affects confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and high privileges, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users and administrators should monitor OnePlus advisories for updates. Until a fix is available, restricting local access and limiting high privilege accounts may reduce risk.