SamsungSEAgentService EUVD-2026-42812

Q: What is the CVSS score of EUVD-2026-42812?

EUVD-2026-42812 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21041 MEDIUM

2026-07-10 mobile.security@samsung.com

GHSA-w6vq-38rc-cfg4

Information Disclosure

6.9

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Local attack vector with no privilege or user-interaction requirement per CVSS 4.0 source; confidentiality impact only, no integrity or availability loss confirmed.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:09 vuln.today

DescriptionCVE.org

Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.

AnalysisAI

Improper access control in SamsungSEAgentService on Samsung Android 15 and 16 devices allows a local attacker to read sensitive information without requiring elevated privileges. The CVSS 4.0 vector (AV:L/PR:N/VC:H) confirms that any local process on the device can trigger the flaw with high confidentiality impact and no integrity or availability loss. No public exploit or CISA KEV listing exists at time of analysis; risk is bounded to the local attack surface of affected Samsung hardware.

Technical ContextAI

SamsungSEAgentService is a proprietary Samsung system service running on Samsung Android devices. The 'SEAgent' naming suggests involvement in Samsung's security or enterprise agent framework, which may handle device policy, credential, or identity data. The flaw is classified as improper access control - the service fails to enforce adequate permission or identity checks before returning sensitive data to the calling process. No CWE was assigned by the reporter, but the vulnerability class aligns broadly with CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization). The CVSS 4.0 vector specifies AV:L (local), AC:L (no special conditions), AT:N (no attack requirement), PR:N (no privileges), and UI:N (no user interaction), meaning any process with local code execution on the device can reach the vulnerable service without needing system or signature-level permissions.

RemediationAI

Apply Samsung's SMR Jul-2026 Release 1 security update, which addresses this access control flaw in SamsungSEAgentService. The update is distributed via Samsung's over-the-air update mechanism and the Samsung Security Update page at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. For enterprise environments where immediate patching is not feasible, compensating controls include restricting device enrollment to managed Android Enterprise profiles that limit sideloading and third-party app installation, thereby reducing the pool of local processes that could reach the vulnerable service. MDM-enforced app allowlisting reduces exposure by preventing untrusted apps from executing locally. These workarounds do not eliminate the flaw but meaningfully reduce the likelihood of exploitation.