CVE-2026-22070: Oppo Coloros Assistant

Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days.

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.

Affected products

• Oppo Coloros Assistant: version 1.4.26 only

Published 2026-04-30. Last modified 2026-06-17.