Which versions of Galaxy Store are affected by CVE-2026-21001?

Organizations using Galaxy Store should be aware of moderate risk from CVE-2026-21001 rated CVSS 5.9. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-21001?

Within 30 days: Identify affected systems running Galaxy Store and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Galaxy Store CVE-2026-21001

Q: What is the CVSS score of CVE-2026-21001?

CVE-2026-21001 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12319 MEDIUM

Path Traversal (CWE-22)

2026-03-16 SamsungMobile

Path Traversal Galaxy Store

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12319

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:32 nvd

MEDIUM 5.9

DescriptionCVE.org

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.

AnalysisAI

Galaxy Store versions prior to 4.6.03.8 contain a path traversal vulnerability that enables local attackers to create files with Galaxy Store privileges. This could allow an attacker with local access to escalate their capabilities by writing malicious files in unintended locations. No patch is currently available for this issue.

Technical ContextAI

This vulnerability is rooted in improper path validation within the Galaxy Store application's file handling logic, classified as a path traversal (CWE-22 equivalent) issue. The Galaxy Store application, identified via CPE string cpe:2.3:a:samsung:galaxy_store, processes user-supplied or application-controlled file paths without adequate sanitization, allowing an attacker with local filesystem access to traverse directory structures (e.g., using '..' sequences or absolute paths) to write files outside intended directories. The affected versions (prior to 4.6.03.8) lack sufficient input validation on file path parameters, enabling the attacker to create or overwrite files in privileged locations where Galaxy Store executes with elevated permissions—a common attack vector in mobile application security where privilege boundaries are not properly enforced.

RemediationAI

Update Samsung Galaxy Store to version 4.6.03.8 or later immediately via the Google Play Store, Samsung Galaxy Store, or Samsung Members app—this is the primary remediation. For users unable to update immediately, implement device-level protections including enabling Android's restricted file system access controls, disabling installation from unknown sources, and restricting local access to the device to trusted users only. If managing devices in a corporate environment, enforce mobile device management (MDM) policies requiring Galaxy Store to be updated to patched versions as a condition of device compliance. Monitor Samsung's official security advisories and security patches for any additional mitigations or follow-up advisories related to this CVE.