CVE-2026-21019

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-210207.8Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcCVE-2026-210216.8Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.CVE-2026-210225.5Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informaCVE-2026-210235.5Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify theCVE-2026-210246.3Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functiCVE-2026-210255.5Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210265.5Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to senCVE-2026-210273.3Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging fCVE-2026-210285.5Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210297.8Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to executeCVE-2026-21037.8Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection stCVE-2026-210307.8Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
CVE-2026-21019: High severity, CVSS 8.6 | Vulnix