# CVE-2026-40436: ZTE ZXEDM iEMS password reset vulnerability in cloud EMS portal

Source: https://junglewise.ai/threats/cve-2026-40436-zte-zxedm-iems-password-reset-vulnerability-in-cloud-ems-portal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40436 · Severity: high · CVSS 7.1 · Published 2026-04-13

ZTE ZXEDM iEMS, a management system for cloud-based Element Management Systems (EMS), contains a security flaw that allows unauthorized access to user data. Attackers can exploit this to view a complete list of system users and subsequently reset their passwords. This could lead to a total takeover of user accounts, allowing unauthorized individuals to perform administrative operations and disrupt critical network management services.

Vendors: [Zte](https://junglewise.ai/threats/vendors/zte).

## Quick answers

**Is CVE-2026-40436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40436 being exploited in the wild.

**How severe is CVE-2026-40436?** High severity, with a CVSS score of 7.1, published 13 April 2026.

**Which products and versions are affected?** ZTE ZXEDM iEMS 16.25.42.04.

**Is there a fix for CVE-2026-40436?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40436 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40436?** Check whether you run Zte Zxedm Iems or Zte Zxesm Iems. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the ZTE ZXEDM iEMS cloud portal stems from improper access control on the user list acquisition interface. A network-based attacker can exploit this lack of authorization to retrieve sensitive information for all registered users. With this information, the attacker can trigger a password reset for any account. While the vendor's CVSS vector suggests some complexity (AC:H) and user interaction (UI:R) may be involved, the primary root cause is a failure to restrict access to administrative user-management functions. Successful exploitation allows for unauthorized operations and full account compromise.

## Affected products

- ZTE ZXEDM iEMS 16.25.42.04

## Timeline

- 2026-04-13: disclosed
- 2026-04-13: advisory

## References

- [https://support.zte.com.cn/zte-iccp-isupport-webui/support/bulletin/security?lang=en_US&t=0.7465962531829456](https://support.zte.com.cn/zte-iccp-isupport-webui/support/bulletin/security?lang=en_US&t=0.7465962531829456)