Which versions of Samsung Bixby are affected by CVE-2026-21074?

Samsung Bixby versions prior to 4.0.86.0 contain a local privilege escalation vulnerability stemming from incorrect default permissions, allowing any local user to execute arbitrary commands within…

How to fix or mitigate CVE-2026-21074?

Within 24 hours: Inventory all Samsung Bixby installations across your infrastructure, with priority focus on shared-device and multi-user enterprise environments where multiple users have local system access. Within 7 days: Begin upgrade to Samsung Bixby version 4.0.86.0 or later, prioritizing high-risk shared-device deployments first; for systems requiring delayed patching, immediately restrict file system permissions on Bixby executable and configuration directories to prevent low-privilege access. Within 30 days: Complete patch deployment across all vulnerable systems, validate version compliance through configuration management systems, and establish continuous monitoring for suspicious or unauthorized Bixby process execution.

Samsung Bixby CVE-2026-21074

Q: What is the CVSS score of CVE-2026-21074?

CVE-2026-21074 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-55099 HIGH

Incorrect Default Permissions (CWE-276)

2026-08-10 SamsungMobile

GHSA-2xcm-9h5p-f5jp

Privilege Escalation Bixby Samsung Mobile

7.2

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

7.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Local vector with low privileges matches the device-access prerequisite; no availability impact and no scope change align with the vendor CVSS 4.0 SC:N/SA:N/VA:N values.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:02 vuln.today

CVE Published

Aug 10, 2026 - 07:42 cve.org

HIGH 7.2

DescriptionCVE.org

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.

AnalysisAI

Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.

Technical ContextAI

Samsung Bixby is the AI-powered voice and ambient-computing assistant integrated into Samsung Galaxy smartphones and select Samsung appliances, identified by CPE cpe:2.3:a:samsung_mobile:bixby:*:*:*:*:*:*:*:*. The vulnerability class - incorrect default permissions - means that file system resources, IPC endpoints, sockets, or service interfaces associated with the Bixby daemon ship with access control settings that are too permissive for unprivileged local users. No CWE was formally assigned, but the flaw most closely aligns with CWE-276 (Incorrect Default Permissions) or CWE-732 (Incorrect Permission Assignment for Critical Resource). The CVSS 4.0 vector includes AT:P (Attack Requirements: Present), indicating a specific runtime precondition - most likely that the Bixby service is running and accessible - though because the flaw is in default permissions, no administrator or user action is required to introduce the vulnerable state.

RemediationAI

Vendor-released patch: Bixby 4.0.86.0. Update Bixby to version 4.0.86.0 or later via Samsung's over-the-air update mechanism or through the Galaxy Store; details are in the Samsung Mobile Security Advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. Where immediate patching is not feasible in managed enterprise fleets, administrators can disable the Bixby service entirely via Samsung Knox or an enrolled MDM profile - this eliminates the vulnerable component from the attack surface but also disables all Bixby voice and ambient-computing functionality, which may affect user workflows. Restricting local shell access and sideloaded application permissions on managed devices reduces the low-privilege attacker prerequisite required to exploit the flaw and serves as an interim compensating control with minimal operational impact.