VulnerabilityPublished 4 Feb 2026

CVE-2026-20982: Samsung Mobile Devices · Path Traversal

Affects Samsung Mobile DevicesSource CVE Database V5

Not known to be exploited · CVSS 6.8 Medium.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 4.0 base score

6.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector: Local
Attack Complexity: Low
Attack Requirements: None
Privileges Required: High
User Interaction: None
Vulnerable system confidentiality: High
Vulnerable system integrity: None
Vulnerable system availability: Low
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: High: The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: High: There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the Vulnerable System are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Samsung MobileSamsung Mobile Devices	Affected–	Fixed in–

AI-suggested

Apply the Samsung Mobile February 2026 Security Maintenance Release 1 or later updates as soon as they become available to remediate the vulnerability.
Enforce strict local privilege management policies to limit the number of users with elevated privileges on mobile devices.
Implement mobile device management (MDM) solutions that can monitor and restrict unauthorized file creation or modification activities on devices.
Conduct regular audits of device configurations and installed applications to detect anomalies indicative of exploitation attempts.
Educate users and administrators about the risks of granting local privileged access and the importance of securing physical device access.
Employ endpoint detection and response (EDR) tools capable of identifying suspicious file system activities related to path traversal exploitation.
Where feasible, restrict physical access to devices and enforce strong authentication mechanisms to reduce the risk of local privilege escalation.
Coordinate with Samsung support channels to receive timely updates and advisories regarding this vulnerability.

Description

CVE-2026-20982 is a medium severity path traversal vulnerability in Samsung Mobile devices' ShortcutService component prior to the SMR February 2026 Release 1. It allows a privileged local attacker to create files with system-level privileges by exploiting improper input validation. The vulnerability requires local access with high privileges but does not require user interaction or authentication beyond that. Although no known exploits are currently reported in the wild, successful exploitation could lead to unauthorized file creation, potentially compromising system integrity. The CVSS 4.0 score is 6.8, reflecting moderate impact and exploitability. European organizations using Samsung Mobile devices, especially those with sensitive data or critical infrastructure, should prioritize patching once updates are available. Countries with high Samsung device penetration and strategic technology sectors are more likely to be affected. Mitigation involves applying the February 2026 security update promptly, restricting local privileged access, and monitoring for suspicious file creation activities.

Impact

For European organizations, the vulnerability poses a moderate risk primarily to the integrity of Samsung Mobile devices used within their infrastructure. Organizations with employees or operations relying heavily on Samsung smartphones or tablets, particularly in sectors like finance, government, healthcare, and critical infrastructure, could face risks if attackers gain local privileged access to devices. The ability to create files with system privileges could enable attackers to implant persistent malware, manipulate system behavior, or bypass security controls. Although exploitation requires local privileged access, insider threats or attackers who gain physical access to devices could leverage this vulnerability. The absence of known exploits reduces immediate risk, but the medium CVSS score and potential impact warrant proactive mitigation. The vulnerability could also affect mobile device management (MDM) strategies and endpoint security policies, requiring updates to detection and response mechanisms. Given the widespread use of Samsung devices in Europe, the threat could have broad implications if exploited at scale or in targeted attacks against high-value targets.

Summary

CVE-2026-20982 is a path traversal vulnerability classified under CWE-35 affecting Samsung Mobile devices' ShortcutService component before the SMR February 2026 Release 1. Path traversal vulnerabilities occur when an application improperly sanitizes user-supplied input, allowing attackers to manipulate file paths to access or create files outside the intended directories. In this case, a privileged local attacker can exploit the vulnerability to create files with system-level privileges, which could be leveraged to escalate privileges further or persist malicious code on the device. The vulnerability requires the attacker to have local privileged access (PR:H) but does not require user interaction (UI:N) or authentication beyond that privilege level. The CVSS 4.0 vector indicates low attack complexity (AC:L) and no need for authentication tokens or user interaction, but the attack surface is limited to local access. The impact is primarily on integrity (VC:H) with limited availability and confidentiality impact. No known exploits have been reported in the wild, but the potential for misuse exists, especially in environments where devices are shared or where privileged access controls are weak. The vulnerability affects all Samsung Mobile devices running software versions prior to the February 2026 security maintenance release, though specific affected versions are not enumerated. The lack of patch links suggests that the update is recent or still being rolled out. The vulnerability's exploitation could allow attackers to place malicious files in system directories, potentially leading to further compromise or persistence mechanisms.

CWE-35Path Traversal: '.../...//' (opens in a new tab)
Variant weaknessOWASP Top 10 A01:2021: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

security.samsungmobile.com/securityUpdate.smsb?year=2026&month=02 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Feb 2026, 11:54 UTC

WeaknessesCWE-35

Technical details

References

Community reviews

Related threats