Samsung Continuity Service CVE-2026-21139

Requires the attacker to be on an adjacent network (AV:A) - within wireless proximity such as the same Wi-Fi/Bluetooth range or local L2 segment - of a Windows host running Samsung Continuity Service below version 4.6.1217.0. The AT:P attack requirement and AC:H complexity indicate exploitation is gated on a specific runtime condition, most plausibly an active, paired Continuity session between the PC and a Samsung mobile device; the flaw targets that live phone-to-PC link rather than an idle installation. No authentication (PR:N) and no user interaction (UI:N) are needed once the condition holds. Limiting factors: remote/internet exploitation is not possible, a mobile device must be actively connected, and the high complexity plus proximity requirement sharply narrow the realistic attacker set to those physically near the target.

This is a genuinely moderate - not top-tier - priority. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N) tells a consistent story: exploitation requires adjacent-network proximity (Bluetooth/Wi-Fi/same L2 segment), has HIGH attack complexity, and carries an explicit attack requirement (AT:P), meaning a specific non-guaranteed condition must be met - most plausibly an active, paired phone-to-PC Continuity session. These three factors (adjacent vector + high complexity + attack requirement) substantially throttle real-world exploitability despite PR:N/UI:N. The impact is notable: confidentiality on the Windows host is high (VC:H) and all three subsequent-system metrics on the connected mobile device are high (SC:H/SI:H/SA:H), matching the description's claim that an attacker can 'manipulate the connected mobile device.' Critically, there is no KEV listing, no public POC, and no EPSS score in the provided data, so there is NO evidence of active or probable exploitation - the 7.3 is driven by impact, not by demonstrated attacker interest. Net: a real but conditional proximity-based flaw, not an internet-wide emergency; patch in normal cycles unless the Galaxy-ecosystem Continuity feature is widely used in your fleet.

An attacker within wireless/adjacent-network range of a Windows PC running Samsung Continuity Service waits for or induces a condition where a Galaxy mobile device is actively linked. Exploiting the improper access control, the attacker issues commands across the Continuity link to read data from or manipulate the connected phone without authenticating. No public exploit code was identified in the provided data, and the high attack complexity plus required paired-session condition make opportunistic exploitation difficult.