Cyber Posture

CVE-2026-21010

Medium

Published: 13 April 2026

Published
13 April 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 6.6 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.3th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21010 is a medium-severity an unspecified weakness vulnerability in Samsung Android. Its CVSS base score is 6.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the improper input validation flaw in Retail Mode by requiring validation and sanitization of all inputs to block triggering of privileged functions by local attackers.

prevent

Enforces approved access control policies to prevent low-privilege local attackers from accessing or executing privileged functions despite the input validation vulnerability.

prevent

Implements least privilege to restrict low-privilege local attackers' capabilities, limiting the scope and impact of any privileged functions triggered via the flaw.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Improper input validation in Retail Mode allows low-privileged local/physical attackers to trigger privileged functions, directly enabling exploitation for privilege escalation with high CIA impact.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.

Deeper analysisAI

CVE-2026-21010 is an improper input validation vulnerability affecting Retail Mode in Samsung devices prior to the SMR Apr-2026 Release 1. This flaw enables local attackers to trigger privileged functions, as documented in the CVE description published on 2026-04-13.

The vulnerability has a CVSS v3.1 base score of 6.6 (AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it requires physical access and low privileges to exploit with low attack complexity and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability by executing privileged functions.

Samsung's security advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 addresses this issue, with mitigation available in the SMR Apr-2026 Release 1 and subsequent updates.

Details

CWE(s)

Affected Products

samsung
android
14.0, 15.0, 16.0

CVEs Like This One

CVE-2025-20890Same product: Samsung Android
CVE-2025-20888Same product: Samsung Android
CVE-2026-20971Same product: Samsung Android
CVE-2026-20979Same product: Samsung Android
CVE-2026-20970Same product: Samsung Android
CVE-2025-20903Same product: Samsung Android
CVE-2026-20983Same product: Samsung Android
CVE-2025-20882Same product: Samsung Android
CVE-2026-20990Same product: Samsung Android
CVE-2025-20881Same product: Samsung Android

References