Samsung Mobile Devices CVE-2026-21008

Q: What is the CVSS score of CVE-2026-21008?

CVE-2026-21008 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21860 MEDIUM

2026-04-13 SamsungMobile

GHSA-hgj3-xj27-6wfp

Information Disclosure Samsung Mobile Devices

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 06:29 vuln.today

CVSS changed

Apr 13, 2026 - 06:22 NVD

5.1 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 06:15 euvd

EUVD-2026-21860

Analysis Generated

Apr 13, 2026 - 06:15 vuln.today

CVE Published

Apr 13, 2026 - 05:09 nvd

MEDIUM 5.1

DescriptionCVE.org

Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.

AnalysisAI

Samsung Mobile S Share application prior to the April 2026 SMR Release 1 exposes sensitive information to adjacent network attackers without requiring authentication, achieved through a low-complexity attack requiring only user interaction. The vulnerability has a CVSS 5.1 score reflecting limited confidentiality impact over an adjacent network, and is addressed in the April 2026 security patch release.

Technical ContextAI

S Share is a Samsung Mobile file-sharing application that operates on local network protocols accessible to adjacent attackers (devices on the same network segment). The vulnerability stems from insufficient access controls or improper data protection mechanisms in the application's information handling routines prior to the April 2026 SMR patch. The CVSS vector indicates an adjacent attack vector (AV:A) with low complexity (AC:L), no timing constraints (AT:N), and no special privileges required (PR:N), though user interaction is necessary (UI:P). The impact is restricted to confidentiality loss (VC:L) with no integrity or availability impact. The affected product classification spans Samsung Mobile devices across all versions prior to the April 2026 update, as indicated by the CPE wildcard pattern for samsung_mobile:samsung_mobile_devices.

RemediationAI

Update Samsung Mobile devices to the April 2026 SMR Release 1 patch or later, which addresses the S Share information exposure vulnerability. Check the Samsung Mobile security update portal at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 for device-specific patch availability and installation instructions. As a temporary mitigation prior to patching, restrict S Share usage on untrusted networks, disable S Share when not in active use, and ensure devices are connected only to trusted Wi-Fi networks (not open or guest networks). Consider disabling Wi-Fi and relying on cellular connectivity for sensitive operations until patched.

More in Samsung Mobile Devices

View all

CVE-2026-21019 HIGH This Week

8.6 May 13

Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy

CVE-2026-21025 MEDIUM This Month

6.9 Jun 05

Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm

CVE-2026-21022 MEDIUM This Month

6.9 May 13

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to acce

CVE-2026-21023 MEDIUM This Month

6.9 Apr 29

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local att

CVE-2026-21018 MEDIUM This Month

6.8 May 13

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary

CVE-2026-21012 MEDIUM This Month

6.8 Apr 13

External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers

CVE-2026-21015 MEDIUM This Month

6.8 May 13

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id

CVE-2026-21010 MEDIUM This Month

6.6 Apr 13

Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with li

CVE-2026-21011 MEDIUM This Month

5.4 Apr 13

Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to byp

CVE-2026-21003 MEDIUM This Month

5.2 Apr 13

Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypas

CVE-2026-21031 MEDIUM This Month

5.2 Jun 05

Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged att

CVE-2026-21021 MEDIUM This Month

5.1 May 13

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged act

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2026-21008 vulnerability details – vuln.today

Back