This vulnerability (CVE-2026-21011) affects Samsung Mobile Devices by incorrectly assigning privileges in the Bluetooth component when the device is in Maintenance mode. This misconfiguration enables physical attackers to bypass the Extend Unlock mechanism, potentially granting unauthorized access. The issue is categorized under CWE-266 (Incorrect Privilege Assignment). The vulnerability was published on April 13, 2026, with a CVSS 4.0 score of 5.4, reflecting medium severity. No patch or official remediation level has been disclosed by Samsung Mobile as of the publication date.

The vulnerability allows physical attackers to bypass the Extend Unlock security feature on affected Samsung Mobile Devices, potentially leading to unauthorized access. The impact is limited to scenarios where an attacker has physical access to the device and can interact with Bluetooth in Maintenance mode. There are no known exploits in the wild, and no cloud service is involved.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Samsung Mobile, users and administrators should monitor for updates from the vendor. Until a patch is available, restricting physical access to devices and disabling Maintenance mode if possible may reduce risk.