VulnerabilityPublished 16 Mar 2026

CVE-2026-20988: Samsung Mobile Devices · : Improper Verification of Intent by Broadcast Receiver

Affects Samsung Mobile DevicesSource CVE Database V5

Compare

Not known to be exploited · CVSS 6.8 Medium.

Data as of 30 Oct 2026, 11:52 UTC

CVSS 4.0 base score

6.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.08% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Local
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: Passive
Vulnerable system confidentiality: High
Vulnerable system integrity: High
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: Low: The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction: Passive: Successful exploitation of this vulnerability requires limited interaction by the targeted user with the vulnerable system and the attacker’s payload. These interactions would be considered involuntary and do not require that the user actively subvert protections built into the vulnerable system.
Vulnerable system confidentiality: High: There is a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Samsung MobileSamsung Mobile Devices	Affected–	Fixed in–

AI-suggested

Apply the official Samsung SMR March 2026 Release 1 update as soon as it becomes available to ensure the vulnerability is patched.
Until patches are deployed, restrict physical and local access to Samsung Mobile devices, especially in high-risk environments.
Educate users to avoid interacting with suspicious notifications, links, or prompts that could trigger malicious intents.
Implement mobile device management (MDM) solutions to enforce security policies and restrict installation of untrusted applications that could exploit local vulnerabilities.
Monitor device behavior for unusual activity related to Settings app launches or privilege escalations.
For organizations, consider additional endpoint protection solutions that can detect anomalous app behavior or privilege escalations on mobile devices.
Coordinate with Samsung support channels to receive timely updates and advisories.
Conduct regular security awareness training focusing on social engineering risks related to user interaction requirements of this vulnerability.

Description

CVE-2026-20988 is a medium-severity vulnerability affecting Samsung Mobile devices prior to the SMR March 2026 Release 1. It involves improper verification of intent by a broadcast receiver in the Settings app, allowing a local attacker with limited privileges to launch arbitrary activities with elevated Settings privileges. Exploitation requires user interaction and local access, meaning the attacker must trick the user into triggering the malicious intent. The vulnerability stems from CWE-925, indicating improper verification of intent, which can lead to privilege escalation within the device. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 6.8, reflecting moderate impact on confidentiality and integrity with limited attack vector and user interaction required. Organizations using Samsung Mobile devices should prioritize patching once updates are available and educate users to avoid suspicious prompts. This vulnerability primarily affects countries with high Samsung mobile device penetration and significant mobile user bases.

Impact

The primary impact of CVE-2026-20988 is unauthorized privilege escalation on affected Samsung Mobile devices. An attacker with local access and limited privileges can exploit this flaw to launch arbitrary activities within the Settings app, potentially modifying device configurations, accessing sensitive settings, or bypassing security controls. This can compromise the confidentiality and integrity of user data and device security settings. Although user interaction is required, social engineering techniques could be used to trick users into triggering the exploit. Organizations relying on Samsung Mobile devices for sensitive communications or operations may face increased risk of device compromise, unauthorized configuration changes, or data leakage. The vulnerability does not affect availability but could facilitate further attacks or persistence mechanisms. Since Samsung devices have significant market share globally, especially in Asia, Europe, and the Americas, the scope of affected systems is large. The lack of known exploits in the wild reduces immediate risk, but the medium severity and ease of local exploitation warrant proactive mitigation to prevent potential targeted attacks.

CWE-925Improper Verification of Intent by Broadcast Receiver (opens in a new tab)
Variant weakness
The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
Architecture and Design
Before acting on the Intent, check the Intent Action to make sure it matches the expected System action.
OWASP ASVS 4.0.3
V1.14.1 (opens in a new tab)
V14.5.2 (opens in a new tab)
V14.5.3 (opens in a new tab)
Attack patterns
Android Intent Intercept (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

security.samsungmobile.com/securityUpdate.smsb?year=2026&month=03 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Mar 2026, 01:08 UTC

WeaknessesCWE-925

Technical details

References

Community reviews

Related threats