CVE-2026-20998
Samsung Smart Switch ≤ 3.7.69.15
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-20998 is a high-severity an unspecified weakness vulnerability in Samsung Smart Switch. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20998 is an improper authentication vulnerability in Samsung Smart Switch prior to version 3.7.69.15. Published on 2026-03-16, the flaw enables remote attackers to bypass authentication mechanisms, as detailed in the NVD with CWE classified as noinfo.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity, no required privileges or user interaction, and no change in scope. Remote attackers can thus achieve high impacts on confidentiality, integrity, and availability by bypassing authentication.
Samsung's security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=03 provides additional details on the issue. Mitigation requires updating Smart Switch to version 3.7.69.15 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12313
Vulnerability Data
Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.