ZTE z80 Ultra vulnerabilities

5 CVEs affecting ZTE z80 Ultra, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108506, published 2026-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-108506, published 2026-10-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant…
CVE-2026-108503, published 2026-10-10. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read…
CVE-2026-108502, published 2026-10-10. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
CVE-2026-108504, published 2026-10-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related…
CVE-2026-108505, published 2026-10-10. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.