Huawei’s September 2026 phone and tablet security bulletin addresses several Huawei-specific vulnerabilities plus a third-party library issue. For international EMUI users, the most relevant entries include a high-severity denial-of-service flaw and two medium-severity permission-control flaws affecting EMUI 15.0.0, 14.2.0 and 14.0.0. Huawei also warns that the timing of security-patch delivery varies by device model and region.
Highlights
- Huawei updated its September 2026 phone/tablet security bulletin on September 5.
- CVE-2026-49315 is rated High and affects listed HarmonyOS and EMUI versions, including EMUI 15.0.0 and 14.2.0.
- CVE-2026-41987 and CVE-2026-49309 are rated Medium and also cover multiple EMUI branches.
- Huawei lists the Pura 80 family for monthly security patches, while the Pura 70 family is currently on a quarterly schedule.
- Actual OTA availability can differ by model and region, so a bulletin date is not a promise that every eligible phone receives an update on the same day.
What Huawei’s September bulletin fixes
| CVE | Huawei description | Severity | Relevant EMUI versions listed |
|---|---|---|---|
| CVE-2026-49315 | Denial-of-service vulnerability in the input-device module; successful exploitation may affect availability. | High | EMUI 16.0.0, 15.0.0, 14.2.0, 14.0.0 |
| CVE-2026-41987 | Permission-control vulnerability in the app-management module; Huawei says exploitation may affect availability. | Medium | EMUI 16.0.0, 15.0.0, 14.2.0, 14.0.0 |
| CVE-2026-49309 | Permission-control vulnerability in Settings; successful exploitation may affect service confidentiality. | Medium | EMUI 16.0.0, 15.0.0, 14.2.0, 14.0.0 |
| CVE-2025-32348 | Third-party library patch included by Huawei. | High | EMUI 16.0.0, 15.0.0, 14.2.0, 14.0.0 |
The bulletin also contains HarmonyOS 6.1.0-specific fixes, including high-severity CVE-2026-49311 and CVE-2026-49314 and several medium-severity issues. Those entries should not be presented as EMUI fixes when Huawei’s affected-version column lists only HarmonyOS 6.1.0.
Which Huawei phones are currently on monthly patches?
Huawei’s current international security-maintenance page lists the Mate X6, Mate XT Ultimate Design, Mate X7 and Mate 80 Pro among monthly Mate-series devices. The Pura 80, Pura 80 Pro and Pura 80 Ultra are also on the monthly list, alongside selected nova 13 and nova 14 models.
The Pura 70, Pura 70 Pro and Pura 70 Ultra are listed under Huawei’s quarterly security programme. That distinction matters when comparing reports of September firmware delivery: being supported does not mean every model follows the same monthly cadence.
Pura 80 and Pura 70 rollout reports: what is confirmed?
Independent Huawei-focused reporting on September 21 says Pura 80-series devices are receiving EMUI 15.0.0.177 and Pura 70 devices are receiving EMUI 14.2.0.247 in some markets. Huawei’s public bulletin independently confirms that EMUI 15.0.0 and 14.2.0 are affected software branches addressed by the September security update, but the bulletin itself does not promise those exact build numbers to every region.
That means users should treat the reported build numbers as rollout-specific evidence, not universal firmware identifiers. Carrier approvals, country firmware branches and staged deployment can change when an OTA appears.
How to check your Huawei phone safely
Check the phone’s normal system-software update screen and compare the installed version and security information with the update offered for your region. Keep adequate battery charge, use a stable connection and back up important data before a major firmware installation. Avoid downloading unofficial firmware packages simply because another country has received a newer build.
If you are comparing Huawei’s newer hardware while considering software support, PhoneSpecX also covers the Huawei Mate XT2 launch and specifications, the Huawei nova 16 specifications, and the Huawei Pura X Max global specifications.
Why the September patch matters
The clearest reason to install the appropriate official update is CVE-2026-49315: Huawei rates this input-device-module denial-of-service issue High and says successful exploitation may affect availability. The September package also addresses permission-control weaknesses that Huawei says can affect availability or service confidentiality.
A severity rating describes potential security impact, not proof that a vulnerability is being widely exploited. Huawei’s bulletin does not state that these listed issues are under active mass exploitation, so users should update promptly without interpreting the advisory as evidence of an ongoing attack.
Frequently Asked Questions
Does Huawei’s September 2026 security update affect EMUI 15?
Yes. Huawei lists EMUI 15.0.0 among the affected versions for CVE-2026-49315, CVE-2026-41987, CVE-2026-49309 and the third-party CVE-2025-32348 patch.
Is EMUI 14.2 included?
Yes. EMUI 14.2.0 appears in Huawei’s affected-version lists for the same security items described above.
Do all Huawei phones receive the September patch at once?
No. Huawei explicitly says security-patch release timing can vary by region and device model, and it maintains both monthly and quarterly update groups.
Are the Pura 70 phones on monthly security updates?
Huawei’s current international maintenance list places the Pura 70, Pura 70 Pro and Pura 70 Ultra in its quarterly security-patch programme, while the Pura 80 family is listed for monthly patches.
Should users install unofficial firmware to get the patch earlier?
No. The safer approach is to use the official update channel for the phone’s own regional firmware branch rather than forcing an unrelated build.
