Samsung SmartThings CVE-2026-21084

Q: What is the CVSS score of CVE-2026-21084?

CVE-2026-21084 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-55109 MEDIUM

Improper Access Control (CWE-284)

2026-08-10 SamsungMobile

GHSA-3gp9-88w5-2g6f

Authentication Bypass Samsung Mobile Smartthings

6.9

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Local attack vector and low privileges confirmed by description and CVSS 4.0 input; high confidentiality loss with minor integrity and availability impact maps directly from 4.0 VC:H/VI:L/VA:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:11 vuln.today

CVE Published

Aug 10, 2026 - 07:44 cve.org

MEDIUM 6.9

DescriptionCVE.org

Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.

AnalysisAI

Improper access control in Samsung SmartThings prior to version 1.8.47.24 allows local attackers with low-privilege access to read sensitive information stored or processed by the application. The vulnerability is rooted in insufficient access control enforcement at the application layer, enabling a co-located or unprivileged user on the same device to reach data they should not be able to access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Samsung SmartThings is a mobile application (CPE: cpe:2.3:a:samsung_mobile:smartthings:*:*:*:*:*:*:*:*) used for home automation and IoT device management. The vulnerability stems from improper access control - meaning the application fails to adequately restrict which local processes, accounts, or users can access sensitive data or internal application resources. No CWE was formally assigned, but the behavior is consistent with CWE-284 (Improper Access Control) or CWE-922 (Insecure Storage of Sensitive Information), where data accessible to the application is not properly sandboxed from other local principals. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L) confirms the attack surface is local - a co-resident low-privilege process or user account on the mobile device.

RemediationAI

The primary fix is to update the SmartThings application to version 1.8.47.24 or later, which Samsung has confirmed resolves this improper access control issue. Users should update through their respective app store (Google Play Store or Samsung Galaxy Store) immediately. The vendor advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08 provides authoritative patch guidance. As a compensating control where immediate update is not possible, administrators managing fleets of devices via MDM should enforce application-level isolation policies and restrict sideloading of untrusted applications that could exploit this weakness. Disabling SmartThings on shared or multi-user devices until patched is a viable interim measure with the trade-off of losing home automation functionality.