Samsung ManagedProvisioning CVE-2026-21140

Exploitation requires local presence on the affected Samsung mobile device - typically a malicious or sideloaded application already running - because the vector is AV:L; it is not remotely reachable. Once local, no additional privileges (PR:N) or user interaction (UI:N) are needed to abuse the improper access control in the ManagedProvisioning component to install arbitrary applications. Exploitation is limited to devices running firmware prior to SMR Sep-2026 Release 1; patched builds remove the exposure. The requirement for an attacker-controlled local app substantially reduces realistic risk versus a remote flaw.

Signals are mixed and point to a moderate, locally-scoped risk rather than an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) describes a local, low-complexity, zero-privilege, zero-interaction flaw scoring 6.9 (Medium), consistent with 'improper access control in ManagedProvisioning' being abusable by any local actor. There is no CISA KEV listing and no EPSS score in the provided data, and no public exploit is referenced - so there is no evidence of active or imminent widespread exploitation (no public exploit identified at time of analysis). A notable internal conflict exists: the CVSS vector sets VC:H (confidentiality impact) and the Tags say 'Information Disclosure,' yet the description states the flaw 'allows local attackers to install arbitrary applications' - that behavior is an integrity impact (unauthorized software installation), not confidentiality/disclosure. This impact-type mismatch should be verified with Samsung's SMB advisory. The AV:L requirement (attacker needs local presence, typically a malicious or sideloaded app already on the device) meaningfully limits real-world reach, keeping this a defense-in-depth patch rather than an emergency.

A low-privilege malicious application already present on a Samsung device (e.g., sideloaded or from an untrusted store) abuses the improper access control in ManagedProvisioning to silently install additional arbitrary applications without user consent or elevated permissions. Because the CVSS vector is AV:L/PR:N/UI:N, no privileges or user interaction are required once the attacker has local code execution, but local presence on the device is a prerequisite. No public exploit code is referenced in the available data.