Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
CVE-2026-20990 is a high-severity vulnerability affecting Samsung Mobile devices' Secure Folder feature prior to the SMR March 2026 Release 1. It involves improper export of Android application components, allowing a local attacker with limited privileges to launch arbitrary activities within the Secure Folder environment. This flaw can lead to significant confidentiality and integrity breaches by enabling unauthorized access to sensitive data and operations protected by Secure Folder. Exploitation requires local access but no user interaction or elevated privileges beyond limited local rights. No known exploits are currently reported in the wild. The vulnerability stems from CWE-926, which concerns improper export of components that should be restricted. Organizations using Samsung Mobile devices with Secure Folder should prioritize patching once updates are available and implement strict local access controls to mitigate risk. Countries with high Samsung device usage and strategic reliance on mobile security are most at risk. Given the high CVSS score (8.4) and potential impact, this vulnerability demands urgent attention from defenders.
CVE-2026-20988 is a medium-severity vulnerability affecting Samsung Mobile devices prior to the SMR March 2026 Release 1. It involves improper verification of intent by a broadcast receiver in the Settings app, allowing a local attacker with limited privileges to launch arbitrary activities with elevated Settings privileges. Exploitation requires user interaction and local access, meaning the attacker must trick the user into triggering the malicious intent. The vulnerability stems from CWE-925, indicating improper verification of intent, which can lead to privilege escalation within the device. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 6.8, reflecting moderate impact on confidentiality and integrity with limited attack vector and user interaction required. Organizations using Samsung Mobile devices should prioritize patching once updates are available and educate users to avoid suspicious prompts. This vulnerability primarily affects countries with high Samsung mobile device penetration and significant mobile user bases.
CVE-2026-20987 is a high-severity vulnerability in Samsung Mobile's GalaxyDiagnostics application caused by improper input validation, allowing local privileged attackers to execute privileged commands. It affects versions prior to 3.5.050 and requires high privileges for exploitation, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full privileged command execution. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected devices. European organizations using Samsung Galaxy devices with GalaxyDiagnostics are at risk, especially those in sectors with sensitive data or critical infrastructure. Mitigation involves promptly updating to GalaxyDiagnostics version 3.5.050 or later, restricting local privileged access, and monitoring for suspicious local activity.
CVE-2026-20986 is a medium-severity path traversal vulnerability affecting the Chinese version of Samsung Members prior to version 15.5.05.4. It allows local attackers to overwrite data within the Samsung Members application by exploiting improper limitation of pathname to restricted directories. The vulnerability does not require authentication, user interaction, or network access, but must be exploited locally. Although no known exploits are currently in the wild, successful exploitation could lead to data integrity issues within the app. The CVSS 4.0 score is 5.1, reflecting limited impact and exploitability.
CVE-2026-20985 is a high-severity vulnerability in Samsung Members app prior to version 5.6.00.11, caused by improper input validation. It allows remote attackers to connect to arbitrary URLs and launch arbitrary activities with Samsung Members privileges. Exploitation requires user interaction but no authentication. The vulnerability could lead to privilege escalation and unauthorized actions within the app. No known exploits are currently reported in the wild. The CVSS 4.0 score is 7.
CVE-2026-20984 is a medium-severity vulnerability in Samsung's Galaxy Wearable app installed on non-Samsung devices prior to version 2.2.68. It involves improper handling of insufficient permissions, allowing local attackers to access sensitive information without requiring authentication or user interaction. The vulnerability arises from inadequate permission checks, classified under CWE-280. Exploitation requires local access but no elevated privileges, making it moderately easy to exploit if an attacker has device access. There are no known exploits in the wild, and no patches have been linked yet. European organizations using Galaxy Wearable on non-Samsung devices could face confidentiality risks. Mitigation involves updating to version 2.2.
Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.
CVE-2026-20982 is a medium severity path traversal vulnerability in Samsung Mobile devices' ShortcutService component prior to the SMR February 2026 Release 1. It allows a privileged local attacker to create files with system-level privileges by exploiting improper input validation. The vulnerability requires local access with high privileges but does not require user interaction or authentication beyond that. Although no known exploits are currently reported in the wild, successful exploitation could lead to unauthorized file creation, potentially compromising system integrity. The CVSS 4.0 score is 6.8, reflecting moderate impact and exploitability. European organizations using Samsung Mobile devices, especially those with sensitive data or critical infrastructure, should prioritize patching once updates are available. Countries with high Samsung device penetration and strategic technology sectors are more likely to be affected. Mitigation involves applying the February 2026 security update promptly, restricting local privileged access, and monitoring for suspicious file creation activities.
CVE-2026-20981 is a medium severity vulnerability in Samsung Mobile devices caused by improper input validation in the FacAtFunction component prior to the SMR February 2026 Release 1. This flaw allows a privileged physical attacker to execute arbitrary commands with system-level privileges. Exploitation requires physical access and privileged status, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise. No known exploits are currently in the wild, and no patches have been linked yet. European organizations using Samsung Mobile devices could be at risk, especially in countries with high Samsung market penetration and critical infrastructure relying on these devices. Mitigation involves restricting physical access, monitoring for unusual system commands, and promptly applying Samsung's security updates once released. Countries like Germany, the UK, France, Italy, and Spain are most likely affected due to their large Samsung user bases and strategic importance. The vulnerability's medium severity reflects the balance between high impact and the requirement for physical privileged access.
CVE-2026-20980 is a high-severity vulnerability affecting Samsung Mobile devices due to improper input validation in the PACM component prior to the SMR Feb-2026 Release 1. This flaw allows a physical attacker to execute arbitrary commands on the device without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 score of 7.0, reflecting its significant impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical nature of mobile devices make this a serious threat. European organizations using Samsung Mobile devices, especially those with sensitive data or critical communications, could face risks of device compromise and data breaches. Mitigation requires timely application of Samsung’s security updates once available, physical device security controls, and monitoring for unusual device behavior. Countries with high Samsung mobile market penetration and strategic importance in technology sectors, such as Germany, the UK, France, and Italy, are most likely to be affected. Defenders should prioritize patch management and physical security to reduce exposure to this vulnerability.
CVE-2026-20978 is a medium severity vulnerability affecting Samsung Mobile Devices, specifically in the KnoxGuardManager component prior to the SMR Feb-2026 Release 1. It involves improper authorization that allows local attackers with limited privileges to bypass the persistence configuration of the application. Exploitation does not require user interaction but does require some level of local privilege. The vulnerability impacts the integrity and availability of the KnoxGuardManager's persistence mechanisms, potentially allowing attackers to maintain unauthorized changes or evade security controls. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices with KnoxGuardManager should prioritize patching once updates are available. Countries with high Samsung device penetration and critical infrastructure relying on mobile security features are most at risk. Mitigation involves applying vendor patches promptly and restricting local access to trusted users only.
CVE-2026-20977 is a medium severity vulnerability affecting Samsung Mobile Devices involving improper access control in the Emergency Sharing feature prior to the SMR February 2026 Release 1. This flaw allows local attackers to interrupt the functioning of Emergency Sharing without requiring authentication or user interaction. The vulnerability does not impact confidentiality, integrity, or availability beyond the Emergency Sharing service but can disrupt critical emergency communication capabilities. Exploitation requires local access to the device, limiting the attack surface to scenarios where an attacker has physical or local access. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices, especially in sectors relying on emergency communication features, should prioritize updating devices once patches are available. Countries with high Samsung mobile market penetration and critical emergency response infrastructure are most likely to be affected. Mitigation involves applying the forthcoming SMR February 2026 Release 1 update and restricting local device access to trusted users. Overall, the vulnerability poses a medium risk due to its limited scope and local attack vector but could impact emergency response reliability if exploited.
The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.
