OpenHarmony RCE: Remote Code Execution in Pre-Installed Apps (CVE-2026-27648)

A critical vulnerability, CVE-2026-27648, has been identified in OpenHarmony v6.0 and prior versions, allowing remote attackers to execute arbitrary code within pre-installed applications. The National Vulnerability Database has assigned a CVSS score of 8.8 (HIGH) to this flaw, underscoring its severe potential impact. This vulnerability is categorized under CWE-787, indicating an out-of-bounds write.

The attacker’s calculus here is straightforward: target default, often unmonitored applications to gain a foothold. The fact that this is remote arbitrary code execution in pre-installed apps means the attack surface is broad, encompassing any device running affected OpenHarmony versions with these applications. For defenders, this isn’t about a niche, custom app; it’s about the foundational software layer.

While specific affected products beyond OpenHarmony versions are not detailed by the National Vulnerability Database, the implication is clear: any device or system leveraging vulnerable OpenHarmony builds is at risk. CISOs must treat this as a high-priority architectural flaw, demanding immediate attention to patch cycles and supply chain integrity for OpenHarmony-based deployments.