Key points
- The flaw is tracked as CVE-2026-70386 with a CVSS score of 8.4.
- Affected software includes OxygenOS 16.0.3.500 and versions before 16.1.10.500.
- The source material does not confirm the availability of a patch or fix.
OnePlus OxygenOS devices running versions before 16.1.10.500, 16.0.5.1200, or 15.0.0.2000 are subject to a high-severity security issue. The vulnerability, identified as CVE-2026-70386, stems from an exposed dangerous method or function within the operating system. According to the National Vulnerability Database, this flaw carries a CVSS score of 8.4, indicating a significant risk to system integrity.
In plain English
The issue involves the unintentional exposure of internal system functions that should remain hidden from standard applications. This allows potentially malicious software to access dangerous methods directly. Such exposure can compromise the security boundaries of the Android environment. The weakness is classified under CWE-749 and CWE-863, highlighting improper handling of exposed functionality. Users on affected versions may face increased risk from malicious apps.
The background
The specific version OnePlus OxygenOS 16.0.3.500 is explicitly listed as affected in the NVD record. The vulnerability impacts any OxygenOS version preceding 16.1.10.500, 16.0.5.1200, and 15.0.0.2000. This means a wide range of devices running older updates are potentially vulnerable. The classification as an "exposed dangerous method" suggests a breakdown in access controls rather than a remote code execution bug.
What changes now
Security teams must identify devices running these specific outdated versions immediately. The source material does not state that a patch or fix exists. Monitoring for exploitation attempts becomes the primary mitigation strategy. Teams should verify current OS versions against the affected list to determine exposure levels.
Who needs to act first
Teams usually prioritize systems with the highest network exposure when facing unpatched vulnerabilities. Check whether critical endpoints are running affected OxygenOS versions and isolate them if possible. Backup important data before attempting any manual workarounds or configuration changes. Reduce the attack surface by restricting app permissions and enforcing strict application whitelisting policies until a vendor solution is available.
What to do and how to stay safe: OnePlus
- Audit device inventory to identify systems running OxygenOS versions prior to the safe thresholds.
- Monitor network traffic for unusual activity that may indicate exploitation of exposed methods.
- Restrict installation of untrusted applications to minimize the risk of abuse.
- Wait for official vendor guidance before applying unverified third-party fixes or updates.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70386?
The National Vulnerability Database rates the severity of CVE-2026-70386 as 8.4, which is considered high.
Which specific OxygenOS version is confirmed to be affected?
OnePlus OxygenOS version 16.0.3.500 is explicitly listed as affected in the source record.
Is there a patch available for this vulnerability?
The provided source material does not mention the existence of a patch or fix.
