Samsung Routines CVE-2026-21022

Q: What is the CVSS score of CVE-2026-21022?

CVE-2026-21022 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29908 MEDIUM

2026-05-13 SamsungMobile

GHSA-mhch-4x3m-c6p5

Information Disclosure Samsung Mobile Devices

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Local vector (AV:L) confirmed by description; PR:N per CVSS 4.0 source vector; no integrity or availability impact indicated; scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:58 vuln.today

CVE Published

May 13, 2026 - 04:56 cve.org

MEDIUM 6.9

CVE Published

May 13, 2026 - 04:56 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

AnalysisAI

Improper permission handling in the Routines automation feature on Samsung Mobile Devices exposes sensitive information to local attackers without requiring elevated privileges. Affected devices run Samsung One UI on Android 15 and Android 16, prior to the SMR May-2026 Release 1 security update. No public exploit has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation as none, consistent with an EPSS score at the 3rd percentile.

Technical ContextAI

The vulnerability resides in Samsung's Routines feature - a built-in One UI automation service allowing users to configure conditional device behaviors - on Android 15 and 16 (CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*). The flaw involves improper handling of permission insufficiency: when the Routines component operates in contexts where its permissions are inadequate, it fails to enforce access restrictions, inadvertently exposing sensitive data to local processes or applications. No CWE was formally assigned by Samsung, but the behavior aligns conceptually with CWE-280 (Improper Handling of Insufficient Permissions or Privileges). The CVSS 4.0 vector AV:L/PR:N/VC:H confirms that the impact is purely a local confidentiality breach with no integrity or availability consequence and no scope change to subsequent systems.

RemediationAI

The definitive fix is to apply SMR May-2026 Release 1, available for Android 15 and Android 16 through Samsung's over-the-air update mechanism or via the Samsung Security Update portal at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05. Organizations managing Samsung device fleets via MDM or EMM solutions may consider restricting or disabling the Routines application as a compensating control prior to patching, though this eliminates automation functionality and may impact user workflows. Additionally, enforcing policies that prevent installation of untrusted applications reduces the local attacker surface that would be needed to trigger this flaw, with the trade-off of restricting user app flexibility.

More in Samsung Mobile Devices

View all

CVE-2026-21019 HIGH This Week

8.6 May 13

Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy

CVE-2026-21068 HIGH This Week

8.4 Aug 10

Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local

CVE-2026-21047 HIGH This Week

8.3 Jul 28

We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Ou

CVE-2026-21064 HIGH This Week

7.0 Aug 10

Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privi

CVE-2026-21058 MEDIUM This Month

6.9 Aug 10

Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local at

CVE-2026-21059 MEDIUM This Month

6.9 Aug 10

Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release

CVE-2026-21025 MEDIUM This Month

6.9 Jun 05

Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm

CVE-2026-21023 MEDIUM This Month

6.9 Apr 29

PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated p

CVE-2026-21063 MEDIUM This Month

6.8 Aug 10

AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application compon

CVE-2026-21018 MEDIUM This Month

6.8 May 13

Out-of-bounds memory write in Samsung's SveService component allows local attackers holding high privileges to execute a

CVE-2026-21012 MEDIUM This Month

6.8 Apr 13

External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers

CVE-2026-21015 MEDIUM This Month

6.8 May 13

FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2026-21022 vulnerability details – vuln.today

Back