CVE-2026-70386

Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

• CWE-78
• CWE-862

• https://blog.nns.ee/2026/09/24/oneplus-root/
• https://blog.nns.ee/2026/09/24/oneplus-root/

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70379When the vSolution Matrix feature is enabled, affected devic…6.5
• CVE-2026-7038A weakness has been identified in tufantunc ssh-mcp up to 1.…3.3
• CVE-2026-70380A denial-of-service vulnerability has been identified in the…5.3
• CVE-2026-70381An access-control vulnerability has been identified in the w…5.3
• CVE-2026-70382Some externally supplied values stored by the device may be …4.1
• CVE-2026-70383Improper Limitation of a Pathname to a Restricted Directory …8.4
• CVE-2026-70387Exposed dangerous method or function and Incorrect Authoriza…8.4
• CVE-2026-70388SOEM version 2.0.0 and earlier contains vulnerabilities wher…8.3
• CVE-2026-7039A security vulnerability has been detected in tufantunc ssh-…7.8
• CVE-2026-70395Improper Neutralization of Special Elements in Data Query Lo…2.1
• CVE-2026-70396Gitea's organization repository-creation API requires write:…5.4
• CVE-2026-70398A flaw was found in multicloud-integrations, a component of …9.6