CVE-2026-20992: Samsung Android Auth Bypass Vulnerability

CVE-2026-20992 Overview

CVE-2026-20992 is an improper authorization vulnerability [CWE-863] in the Samsung Android Settings component. The flaw allows a local attacker to disable the ability to configure background data usage for applications. Samsung addressed the issue in the SMR Mar-2026 Release 1 security maintenance update.

The vulnerability affects Samsung Android versions 13.0, 14.0, 15.0, and 16.0 prior to the March 2026 patch. Exploitation requires local access and low privileges, with no user interaction needed. The flaw does not enable remote code execution or privilege escalation but undermines a user-facing data management control.

Critical Impact

A local attacker with low privileges can disable background data usage configuration for applications, bypassing an intended user control on the device.

Affected Products

• Samsung Android 13.0 (prior to SMR Mar-2026 Release 1)
• Samsung Android 14.0 (prior to SMR Mar-2026 Release 1)
• Samsung Android 15.0 and 16.0 (prior to SMR Mar-2026 Release 1)

Discovery Timeline

• 2026-03-16 - CVE-2026-20992 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-20992

Vulnerability Analysis

The vulnerability resides in the Samsung Settings application on affected Android builds. Samsung classifies it as an improper authorization issue, mapped to [CWE-863]. The Settings component fails to correctly verify whether a caller is authorized to alter the background data usage configuration interface for installed applications.

Because the authorization check is missing or insufficient, a local actor can manipulate the control surface that governs background data permissions. The integrity impact is limited to a single configuration path, and there is no observed confidentiality or availability impact. The attack requires the adversary to already possess code execution or shell access at low privilege on the device.

Root Cause

The root cause is an authorization weakness in the Settings code path that exposes the background data usage configuration. The component does not enforce the access control policy required before allowing modifications to this setting. Samsung's March 2026 SMR bulletin describes the resolution as an authorization correction within Settings.

Attack Vector

Exploitation is local. An attacker requires an existing foothold on the device, such as a malicious application installed by the user or a compromised low-privilege process. No user interaction is required at the moment of exploitation, and the attack complexity is low. The result is the ability to disable configuration of background data usage for applications, which can be abused to suppress user oversight of data-consuming apps.

No public proof-of-concept code, exploit module, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-20992

Indicators of Compromise

• Unexpected changes to the background data usage state for installed applications without user action.
• Installed third-party applications requesting or invoking Settings-related intents outside their normal functional scope.
• Devices running Samsung Android 13.0, 14.0, 15.0, or 16.0 without the SMR Mar-2026 Release 1 patch level.

Detection Strategies

• Inventory Samsung Android endpoints via Mobile Device Management (MDM) and flag devices whose security patch level is earlier than 2026-03-01.
• Monitor application behavior for unauthorized interaction with the com.android.settings package, especially actions targeting data usage controls.
• Use mobile threat defense telemetry to identify side-loaded or recently installed applications on affected builds.

Monitoring Recommendations

• Track Samsung Mobile Security bulletins and correlate patch level metadata reported by enrolled devices.
• Alert when applications attempt to programmatically modify background data policy without an explicit user-initiated flow.
• Review device compliance reports to confirm SMR Mar-2026 Release 1 adoption across the fleet.

How to Mitigate CVE-2026-20992

Immediate Actions Required

• Apply the Samsung SMR Mar-2026 Release 1 security maintenance update to all affected Samsung Android 13.0, 14.0, 15.0, and 16.0 devices.
• Enforce MDM policy that blocks enrollment or access for devices below the March 2026 patch level.
• Restrict installation of untrusted applications, since exploitation requires a local foothold.

Patch Information

Samsung released the fix in the March 2026 Security Maintenance Release. See the Samsung Mobile Security Update March 2026 advisory for the full bulletin and device coverage.

Workarounds

• No vendor-supplied workaround is documented; install the SMR Mar-2026 Release 1 update.
• Limit device exposure by allowing only vetted applications from Google Play and Samsung Galaxy Store.
• Periodically audit the background data usage configuration for installed applications to detect tampering.

# Configuration example: verify Samsung security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-03-01 or later