EUVD-2026-21858
GHSA-mfwr-v65c-m55q
Severity by source
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.
AnalysisAI
Device Care in Samsung Mobile devices prior to the April 2026 SMR Release 1 contains an improper exception handling vulnerability that permits physical attackers to bypass Knox Guard authentication enforcement. With a CVSS score of 4.4 and attack vector requiring physical access, this vulnerability poses a localized but serious integrity and confidentiality risk to device security architecture, particularly for devices left unattended or in corporate environments where physical access controls may be compromised.
Technical ContextAI
Device Care is a Samsung system application responsible for device maintenance and optimization; Knox Guard is Samsung's enterprise-grade defense mechanism integrated into the Knox security platform. The vulnerability resides in inadequate validation of exceptional conditions within Device Care's code path, likely in initialization, permission-checking, or state-transition logic that interfaces with Knox Guard's security enforcement layer. The root cause appears to be improper exception handling (CWE categorization not provided) that allows control flow to bypass or skip critical authentication or authorization checks. Physical attack vector combined with the ability to modify authentication state suggests the vulnerability may be triggered through direct hardware manipulation, bootloader-level access, or exploitation of a race condition that requires proximity to the device.
RemediationAI
Device owners and enterprise administrators must update affected Samsung Mobile devices to the April 2026 SMR Release 1 or later as soon as patches become available. Vendor-released patch details including exact firmware versions will be published in Samsung's April 2026 security bulletin accessible at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04. Until patching is completed, organizations should enforce strict physical security controls over Samsung devices, including secure storage, locked device cabinets, and restricted access in high-risk environments. Knox Guard remote management features should be leveraged to monitor and enforce compliance posture across device fleets. For devices that cannot be immediately patched due to operational constraints, consider disabling or limiting local physical access pathways if technically feasible (e.g., USB debugging restrictions, bootloader lock enforcement via Knox).
More in Samsung Mobile Devices
View allOut-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of li
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimage
Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthe
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to e
Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling l
Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today