CVE-2026-20981 Overview
CVE-2026-20981 is an improper input validation vulnerability in the FacAtFunction component of Samsung Android. The flaw affects devices running Samsung Android 14, 15, and 16 prior to the SMR Feb-2026 Release 1 security maintenance update. A privileged physical attacker can supply crafted input to FacAtFunction and execute arbitrary commands with system privileges. Successful exploitation grants the attacker the ability to run code in the context of the system user, breaking the Android privilege model on the affected device. Samsung addressed the issue in its February 2026 Security Maintenance Release.
Critical Impact
Arbitrary command execution with system privileges on Samsung Android devices, achievable by a privileged physical attacker through crafted input to the FacAtFunction component.
Affected Products
- Samsung Android 14.0 prior to SMR Feb-2026 Release 1
- Samsung Android 15.0 prior to SMR Feb-2026 Release 1
- Samsung Android 16.0 prior to SMR Feb-2026 Release 1
Discovery Timeline
- 2026-02-04 - CVE-2026-20981 published to NVD
- 2026-02-05 - Last updated in NVD database
Technical Details for CVE-2026-20981
Vulnerability Analysis
The vulnerability resides in FacAtFunction, a Samsung-specific component handling factory AT (attention) commands on Samsung Android devices. AT command interfaces are typically reachable through diagnostic ports or service-mode flows used during manufacturing and repair. The component fails to validate input properly before passing it to a command execution path. An attacker with physical access and elevated privileges on the device can craft input that the handler interprets as an executable command. The handler then runs that command in the system context, providing access to system-owned resources, services, and APIs. The flaw is tracked under [NVD-CWE-noinfo] because the precise weakness classification has not been published by Samsung or NVD.
Root Cause
The root cause is missing or insufficient sanitization of attacker-controlled input parameters consumed by FacAtFunction. Because the function ultimately invokes command execution logic, unvalidated input can be incorporated into the executed command. This pattern is consistent with command injection through AT command handlers in mobile baseband and service-mode components.
Attack Vector
Exploitation requires physical access to the target device and prior privilege on the system, consistent with the CVSS vector components for physical attack vector and required attack prerequisites. A typical exploitation path involves connecting to a diagnostic or service interface, entering a state in which FacAtFunction is reachable, and submitting crafted parameters that escape the intended command structure. Because remote network access is not part of the attack chain, mass exploitation is unlikely, but targeted scenarios such as evil-maid attacks, device forensics bypass, or supply-chain tampering are realistic abuse cases.
No public proof-of-concept code, exploit, or technical write-up has been published for CVE-2026-20981 at this time. Refer to the Samsung Security Update February 2026 advisory for vendor-supplied details.
Detection Methods for CVE-2026-20981
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-20981.
- Unexpected interactive sessions over diagnostic, ADB, or service-mode interfaces on Samsung devices should be treated as suspicious in enterprise fleets.
- Unexplained processes or files created by the system user on managed Samsung Android endpoints warrant investigation.
Detection Strategies
- Inventory Samsung Android 14, 15, and 16 devices through your mobile device management (MDM) platform and flag any device whose security patch level is older than SMR Feb-2026 Release 1.
- Monitor MDM compliance signals for developer options, USB debugging, and OEM unlock state changes on Samsung devices.
- Correlate physical access events such as device check-in/check-out or repair workflows with subsequent anomalous device behavior.
Monitoring Recommendations
- Enforce attestation checks (Play Integrity or Samsung Knox attestation) before granting access to corporate resources.
- Alert on Samsung devices reporting a security patch level prior to 2026-02-01 after the patch becomes available in your region.
- Review chain-of-custody for managed devices that leave user control, including loaners, repaired units, and devices returned from travel.
How to Mitigate CVE-2026-20981
Immediate Actions Required
- Apply the Samsung SMR Feb-2026 Release 1 security update to all Samsung Android 14, 15, and 16 devices as soon as it is available for the device model.
- Use MDM policies to block corporate access from Samsung devices that have not received the February 2026 patch level.
- Restrict physical access to managed devices and enforce strong device passcodes and biometric locks.
Patch Information
Samsung addressed CVE-2026-20981 in the SMR Feb-2026 Release 1 security maintenance release. Patch availability varies by carrier and device model. Consult the Samsung Security Update February 2026 advisory for the list of patched models and applicable build numbers.
Workarounds
- Disable USB debugging and developer options on production devices through MDM until the patch is installed.
- Configure MDM to disable access to factory and service-mode menus where supported by Samsung Knox.
- Maintain strict physical custody of devices and avoid leaving devices unattended in untrusted environments until the SMR Feb-2026 Release 1 update is applied.
# Example: query Samsung Android security patch level via ADB to confirm patching
adb shell getprop ro.build.version.security_patch
# Expected output after remediation: 2026-02-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
