CVE-2026-21074

HighCVSS 7.2/10Last modified Oct 23, 2026

Description

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.

Metrics

CVSS 4.0 7.2/10CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-276

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 10, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-210755.3Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive informCVE-2026-210765.5Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210775.5Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210786.5Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to CVE-2026-210796.5Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.CVE-2026-21087.5A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of tCVE-2026-210806.5Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.CVE-2026-210815.1Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivCVE-2026-210825.5Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210836.5Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.CVE-2026-210846.9Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.CVE-2026-210856.7Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVE-2026-21074: High severity, CVSS 7.2 | Vulnix