Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.
Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.
Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
CVE-2026-20990 is a high-severity vulnerability affecting Samsung Mobile devices' Secure Folder feature prior to the SMR March 2026 Release 1. It involves improper export of Android application components, allowing a local attacker with limited privileges to launch arbitrary activities within the Secure Folder environment. This flaw can lead to significant confidentiality and integrity breaches by enabling unauthorized access to sensitive data and operations protected by Secure Folder. Exploitation requires local access but no user interaction or elevated privileges beyond limited local rights. No known exploits are currently reported in the wild. The vulnerability stems from CWE-926, which concerns improper export of components that should be restricted. Organizations using Samsung Mobile devices with Secure Folder should prioritize patching once updates are available and implement strict local access controls to mitigate risk. Countries with high Samsung device usage and strategic reliance on mobile security are most at risk. Given the high CVSS score (8.4) and potential impact, this vulnerability demands urgent attention from defenders.
CVE-2026-20988 is a medium-severity vulnerability affecting Samsung Mobile devices prior to the SMR March 2026 Release 1. It involves improper verification of intent by a broadcast receiver in the Settings app, allowing a local attacker with limited privileges to launch arbitrary activities with elevated Settings privileges. Exploitation requires user interaction and local access, meaning the attacker must trick the user into triggering the malicious intent. The vulnerability stems from CWE-925, indicating improper verification of intent, which can lead to privilege escalation within the device. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 6.8, reflecting moderate impact on confidentiality and integrity with limited attack vector and user interaction required. Organizations using Samsung Mobile devices should prioritize patching once updates are available and educate users to avoid suspicious prompts. This vulnerability primarily affects countries with high Samsung mobile device penetration and significant mobile user bases.
CVE-2026-20987 is a high-severity vulnerability in Samsung Mobile's GalaxyDiagnostics application caused by improper input validation, allowing local privileged attackers to execute privileged commands. It affects versions prior to 3.5.050 and requires high privileges for exploitation, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full privileged command execution. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected devices. European organizations using Samsung Galaxy devices with GalaxyDiagnostics are at risk, especially those in sectors with sensitive data or critical infrastructure. Mitigation involves promptly updating to GalaxyDiagnostics version 3.5.050 or later, restricting local privileged access, and monitoring for suspicious local activity.
CVE-2026-20986 is a medium-severity path traversal vulnerability affecting the Chinese version of Samsung Members prior to version 15.5.05.4. It allows local attackers to overwrite data within the Samsung Members application by exploiting improper limitation of pathname to restricted directories. The vulnerability does not require authentication, user interaction, or network access, but must be exploited locally. Although no known exploits are currently in the wild, successful exploitation could lead to data integrity issues within the app. The CVSS 4.0 score is 5.1, reflecting limited impact and exploitability.
CVE-2026-20985 is a high-severity vulnerability in Samsung Members app prior to version 5.6.00.11, caused by improper input validation. It allows remote attackers to connect to arbitrary URLs and launch arbitrary activities with Samsung Members privileges. Exploitation requires user interaction but no authentication. The vulnerability could lead to privilege escalation and unauthorized actions within the app. No known exploits are currently reported in the wild. The CVSS 4.0 score is 7.
CVE-2026-20984 is a medium-severity vulnerability in Samsung's Galaxy Wearable app installed on non-Samsung devices prior to version 2.2.68. It involves improper handling of insufficient permissions, allowing local attackers to access sensitive information without requiring authentication or user interaction. The vulnerability arises from inadequate permission checks, classified under CWE-280. Exploitation requires local access but no elevated privileges, making it moderately easy to exploit if an attacker has device access. There are no known exploits in the wild, and no patches have been linked yet. European organizations using Galaxy Wearable on non-Samsung devices could face confidentiality risks. Mitigation involves updating to version 2.2.
