CVE-2026-27766 — in OpenHarmony v6.0 and prior versions allow a local

title: Local Information Leak via OpenHarmony Vulnerability — CVE-2026-27766
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-27766 by monitoring for the execution of common shell commands that could be used to leak system information on OpenHarmony v6.0 and prior versions. The vulnerability allows local attackers to cause information leaks.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-27766/
tags:
  - attack.privilege_escalation
  - attack.t1219
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - '/system/bin/sh'
      CommandLine|contains:
          - 'cat /proc/version'
          - 'cat /proc/cpuinfo'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse