# CVE-2026-11535: Vivo PcSuite authentication bypass in Bluetooth function

Source: https://junglewise.ai/threats/cve-2026-11535-vivo-pcsuite-authentication-bypass-in-bluetooth-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-11535 · Severity: info · CVSS 8.7 · Published 2026-06-12

Vivo PcSuite, a tool used to manage mobile devices from a computer, contains a security flaw in its authentication process. An attacker within Bluetooth range could exploit this defect to bypass security checks and access sensitive information from the connected device. This could lead to the unauthorized exposure of personal data or files stored on the phone.

Vendors: [Vivo](https://junglewise.ai/threats/vendors/vivo).

## Quick answers

**Is CVE-2026-11535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11535 being exploited in the wild.

**How severe is CVE-2026-11535?** Informational severity, with a CVSS score of 8.7, published 12 June 2026.

**Which products and versions are affected?** Vivo PcSuite Versions below 6.2.5.

**Is there a fix for CVE-2026-11535?** A patch was published on 2026-06-12: Fixed in version 6.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11535 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-11535?** Check whether you run Vivo PcSuite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability (CWE-306) exists in a specific function of Vivo PcSuite. The flaw resides in the authentication mechanism used during device-to-PC communication. An unauthenticated attacker within Bluetooth range (Adjacent vector) can exploit this defect to bypass security controls. Successful exploitation allows the attacker to leak sensitive information or potentially modify data on the target device. The vulnerability is addressed in PcSuite version 6.2.5.

## Affected products

- Vivo PcSuite Versions below 6.2.5

## Timeline

- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched: Fixed in version 6.2.5

## References

- [https://www.vivo.com/en/support/security-advisory-detail?id=22](https://www.vivo.com/en/support/security-advisory-detail?id=22)

## Related threats

- [Vivo PcSuite connection confirmation bypass](https://junglewise.ai/threats/cve-2026-12058-vivo-pcsuite-connection-confirmation-bypass)