CVE-2026-20972VulnerabilityPublished 9 Jan 2026

CVE-2026-20972: Samsung Mobile Devices · : Improper Export of Android Application Components

Affects Samsung Mobile DevicesSource CVE Database V5

Not known to be exploited · CVSS 4.8 Medium.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 4.0 base score

4.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector: Local
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: None
Vulnerable system availability: Low
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: Low: The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Samsung MobileSamsung Mobile Devices	Affected–	Fixed in–

AI-suggested

Mitigation should focus on minimizing local attack vectors and ensuring devices are updated promptly. European organizations should: 1) Apply the SMR Jan-2026 Release 1 or later firmware updates from Samsung as soon as they become available to patch the vulnerability. 2) Restrict physical and local access to devices, enforcing strong endpoint security policies to prevent unauthorized app installations or privilege escalations. 3) Monitor device logs and UWB usage patterns for unusual activation or behavior indicative of exploitation. 4) Use Mobile Device Management (MDM) solutions to enforce application whitelisting and control component exports where possible. 5) Educate users about the risks of installing untrusted applications that could exploit local vulnerabilities. 6) Coordinate with Samsung support channels for vulnerability disclosures and remediation guidance. 7) Consider disabling UWB functionality on devices where it is not required to reduce the attack surface.

Description

CVE-2026-20972 is a medium severity vulnerability affecting Samsung Mobile devices, caused by improper export of Android application components in the UwbTest app prior to the SMR Jan-2026 Release 1. This flaw allows local attackers with limited privileges to enable Ultra-Wideband (UWB) functionality without user interaction or elevated authentication. The vulnerability arises from CWE-926, which involves improper export of application components, potentially exposing sensitive device capabilities. Although no known exploits are currently reported in the wild, the vulnerability could be leveraged to manipulate UWB features, possibly impacting device confidentiality or integrity. The CVSS score of 4.8 reflects a moderate risk due to the local attack vector and required privileges. European organizations using Samsung Mobile devices with affected firmware versions should be aware of this issue and apply vendor updates once available. Mitigation involves restricting local access, monitoring device behavior, and applying security patches promptly. Countries with high Samsung Mobile market penetration and strategic use of UWB technology, such as Germany, France, and the UK, are most likely to be impacted.

Impact

For European organizations, the impact of CVE-2026-20972 centers on the unauthorized enabling of UWB functionality on Samsung Mobile devices. UWB is increasingly used in secure access control, asset tracking, and proximity-based authentication systems. Unauthorized activation could lead to privacy breaches, unauthorized tracking, or manipulation of device communications. Although the vulnerability requires local access and limited privileges, insider threats or compromised endpoints could exploit this to bypass security controls or gather sensitive location data. This could affect sectors such as finance, government, and critical infrastructure where Samsung devices are prevalent. The medium severity rating reflects moderate risk, but the potential for chained attacks or privacy violations elevates concern. Disruption or misuse of UWB could undermine trust in device security and impact compliance with European data protection regulations like GDPR if personal data is exposed.

Summary

CVE-2026-20972 is a vulnerability identified in Samsung Mobile devices related to the improper export of Android application components within the UwbTest application prior to the SMR (Security Maintenance Release) January 2026 Release 1. The root cause is classified under CWE-926, which pertains to improper export of components, allowing unauthorized access to internal application functionalities. Specifically, this vulnerability enables local attackers with limited privileges (PR:L) to activate Ultra-Wideband (UWB) capabilities on the device without requiring user interaction or elevated authentication. UWB is a short-range wireless communication protocol used for precise spatial awareness and device-to-device communication, often leveraged in secure device pairing, location tracking, and data exchange. The vulnerability does not require network access (AV:L), meaning exploitation must be performed locally, such as through a malicious app or compromised user environment. The CVSS 4.0 vector indicates low attack complexity (AC:L), no privileges required beyond limited local privileges, and no user interaction needed (UI:N). The impact primarily affects the availability and integrity of the UWB feature, potentially allowing unauthorized activation or manipulation of UWB functions. While no known exploits are currently reported in the wild, the exposure of UWB controls could facilitate further attacks or privacy violations if combined with other vulnerabilities. The lack of a patch link suggests that remediation is expected in or after the SMR Jan-2026 Release 1. Organizations relying on Samsung Mobile devices should monitor for updates and assess device configurations to mitigate risk.

CWE-926Improper Export of Android Application Components (opens in a new tab)
Variant weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Build and Compilation · Attack Surface Reduction
If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
Build and Compilation · Attack Surface Reduction
If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
Build and Compilation · Architecture and Design · Attack Surface Reduction
Limit Content Provider permissions (read/write) as appropriate.
OWASP Cheat Sheets
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

security.samsungmobile.com/securityUpdate.smsb?year=2026&month=01 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Jan 2026, 10:01 UTC

WeaknessesCWE-926

Technical details

References

Community reviews

Related threats