Which versions of Galaxy Store are affected by CVE-2026-21000?

Samsung Galaxy Store versions prior to 4.6.03.8 contain a local privilege escalation vulnerability that could allow malicious applications or users with device access to gain elevated permissions and…

How to fix or mitigate CVE-2026-21000?

Within 24 hours: Inventory all devices running Samsung Galaxy Store and identify those on affected versions (pre-4.6.03.8); communicate risk to device owners. Within 7 days: Disable Galaxy Store on high-risk devices or restrict its use through Mobile Device Management (MDM) policies; require users to avoid third-party app installations from untrusted sources. Within 30 days: Monitor Samsung security announcements for patch availability; prepare deployment procedures to automatically update Galaxy Store once patched versions are released.

Galaxy Store CVE-2026-21000

Q: What is the CVSS score of CVE-2026-21000?

CVE-2026-21000 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12317 HIGH

Path Traversal (CWE-22)

2026-03-16 SamsungMobile

Path Traversal Galaxy Store

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12317

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:32 nvd

HIGH 7.0

DescriptionCVE.org

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.

AnalysisAI

Galaxy Store versions prior to 4.6.03.8 contain an access control flaw that enables local attackers to create files with elevated Galaxy Store privileges. This vulnerability affects local users on affected devices and could allow privilege escalation or persistence mechanisms. No patch is currently available.

Technical ContextAI

The vulnerability stems from improper access control mechanisms within Samsung's Galaxy Store application, which is the official app marketplace for Samsung Galaxy devices. While no specific CWE classification is provided, the issue allows local attackers to bypass intended security boundaries and create files with the elevated privileges of the Galaxy Store process. This type of vulnerability typically occurs when applications fail to properly validate or restrict file operations, allowing unprivileged processes to leverage the app's permissions for malicious purposes.

RemediationAI

Update Samsung Galaxy Store to version 4.6.03.8 or later through the Galaxy Store app settings or via Samsung's automatic update mechanism. For devices that cannot be immediately updated, restrict local access to trusted users only and avoid installing applications from untrusted sources. Enterprise administrators should prioritize updates for shared or kiosk devices where local access control is more difficult to maintain. Monitor Samsung's security bulletins for any additional guidance or patches related to this vulnerability.