What is the CVSS score of CVE-2026-20992?

CVE-2026-20992 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Samsung Mobile Devices are affected by CVE-2026-20992?

CVE-2026-20992 is a low-severity vulnerability in Settings (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-20992?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Samsung Mobile Devices CVE-2026-20992

EUVD-2026-12301 LOW

Incorrect Authorization (CWE-863)

2026-03-16 SamsungMobile

Authentication Bypass Samsung Mobile Devices Samsung Mobile

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12301

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:31 nvd

LOW 3.3

DescriptionCVE.org

Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.

AnalysisAI

An improper authorization vulnerability in Samsung Settings allows a local attacker with low privileges to disable configuration of background data usage for applications prior to the SMR Mar-2026 Release 1 patch. While the CVSS score of 4.8 is moderate, the vulnerability has limited impact as it only affects the integrity of data usage settings without enabling data exfiltration or system compromise. The local attack vector and requirement for user-level privileges significantly reduce real-world exploitation likelihood compared to remote or privilege-escalation vulnerabilities.

Technical ContextAI

This vulnerability exists in Samsung's Settings application, a core system component responsible for managing device configuration parameters including network and data usage policies. The root cause is classified as improper authorization, meaning the Settings application fails to properly validate or enforce access controls when processing requests to modify background data usage configurations. The vulnerability likely stems from insufficient privilege checks or capability validation before allowing changes to application-level data usage restrictions, permitting a local authenticated user to bypass intended access controls. No specific CWE was assigned in the CVE record, but this aligns with CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-862 (Missing Authorization) patterns common in mobile OS settings implementations.

RemediationAI

Apply Samsung's SMR Mar-2026 Release 1 security patch or later to affected devices immediately through standard OTA update mechanisms. Users should navigate to Settings > About device > Software update and install available security updates. Organizations managing Samsung devices should enforce automatic security updates through Mobile Device Management (MDM) platforms such as Samsung Knox Configure or third-party MDM solutions. As a temporary workaround pending patch deployment, restrict Settings application access via MDM policy where feasible, though this may degrade user experience. Samsung customers requiring additional guidance should contact Samsung Support or review the official security advisory published in Samsung's Security Advisory Center (https://security.samsungmobile.com/).