CVE-2026-21010
Published: 13 April 2026
Summary
CVE-2026-21010 is a medium-severity an unspecified weakness vulnerability in Samsung Android. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-21010 is an improper input validation vulnerability affecting Retail Mode in Samsung devices prior to the SMR Apr-2026 Release 1. This flaw enables local attackers to trigger privileged functions, as documented in the CVE description published on 2026-04-13.
The vulnerability has a CVSS v3.1 base score of 6.6 (AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it requires physical access and low privileges to exploit with low attack complexity and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability by executing privileged functions.
Samsung's security advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 addresses this issue, with mitigation available in the SMR Apr-2026 Release 1 and subsequent updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21864
Vulnerability details
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in Retail Mode allows low-privileged local/physical attackers to trigger privileged functions, directly enabling exploitation for privilege escalation with high CIA impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the improper input validation flaw in Retail Mode by requiring validation and sanitization of all inputs to block triggering of privileged functions by local attackers.
Enforces approved access control policies to prevent low-privilege local attackers from accessing or executing privileged functions despite the input validation vulnerability.
Implements least privilege to restrict low-privilege local attackers' capabilities, limiting the scope and impact of any privileged functions triggered via the flaw.