The vulnerability identified as CVE-2026-86556 in the ZTE U30 Air involves improper privilege management (CWE-269) that leads to information disclosure. Attackers can exploit this weakness to access information that should be protected by permission controls. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, impacting confidentiality but not integrity or availability. No vendor advisory or patch information is available to confirm remediation status.

The impact is limited to information disclosure, potentially exposing sensitive data to unauthorized parties. There is no indication of integrity or availability compromise. The medium severity reflects the moderate risk posed by this vulnerability given its ease of exploitation and confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.