CVE-2026-21098: Link to Windows Auth Bypass Vulnerability

CVE-2026-21098 Overview

CVE-2026-21098 is an improper access control vulnerability [CWE-284] in Samsung's Link to Windows application. The flaw exists in versions prior to the SMR Sep-2026 Release 1 security maintenance release. A local attacker can establish a connection between the mobile device and a paired PC without requiring the expected user interaction step. The issue affects the availability of the target system, as reflected in the CVSS 4.0 vector, but does not directly compromise confidentiality or integrity.

Critical Impact
Local attackers with physical or on-device access can initiate an unauthorized Link to Windows connection to a PC, bypassing the user-consent control that normally gates the pairing workflow.

Affected Products

Samsung Link to Windows application on Galaxy devices
Versions prior to SMR Sep-2026 Release 1
Samsung Android devices receiving the September 2026 SMR

Discovery Timeline

2026-09-09 - CVE-2026-21098 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-21098

Vulnerability Analysis

Link to Windows is Samsung's companion service that mirrors notifications, messages, calls, and screen content between a Galaxy device and a paired Windows PC. The application enforces a user-interaction gate before a session is established, ensuring the device owner authorizes the connection. CVE-2026-21098 breaks that assumption. The vulnerability allows a local attacker to reach the connection-establishment code path without triggering the interactive consent prompt.

Because the attack vector is local, exploitation requires the attacker to be running code on the device or to have direct physical access. Once the connection is established, the paired PC becomes reachable through the Link to Windows channel, which can be abused to disrupt normal device or PC functionality.

Root Cause

The root cause is classified as improper access control [CWE-284]. The Link to Windows component fails to enforce a required authorization step before invoking the pairing or connection routine. An attacker who can invoke the affected interface bypasses the expected user-interaction check.

Attack Vector

Exploitation is local. The attacker triggers the vulnerable code path on the mobile device to initiate a connection to a previously known or attacker-controlled PC endpoint. No network access is required and no privileges are needed to reach the vulnerable interface. The impact is limited to availability of the connected system, per the published CVSS 4.0 metrics.

No public proof-of-concept exploit is available at the time of publication. Refer to the Samsung Mobile Security Update advisory for vendor-specific technical details.

Detection Methods for CVE-2026-21098

Indicators of Compromise

Link to Windows pairing or session-establishment events on a Galaxy device that did not correspond to an on-screen user consent prompt.
Unexpected Link to Windows notifications, messaging, or screen-mirroring sessions initiated to a PC.
Presence of the Link to Windows application at a build predating the SMR Sep-2026 Release 1 patch level.

Detection Strategies

Audit Android device build fingerprints and security patch levels to identify devices not yet updated to SMR Sep-2026 Release 1 or later.
Correlate Link to Windows connection events on managed PCs against expected user activity windows to surface off-hours or unattended pairings.
Review mobile device management (MDM) telemetry for Link to Windows package activity on devices where the feature is not sanctioned.

Monitoring Recommendations

Enable endpoint logging on Windows hosts that use Phone Link and forward pairing and session events to a central SIEM.
Track Samsung monthly SMR release adoption across the Galaxy device fleet to measure exposure over time.
Alert on new Link to Windows device pairings introduced outside of a change window or provisioning workflow.

How to Mitigate CVE-2026-21098

Immediate Actions Required

Apply the Samsung SMR Sep-2026 Release 1 update to all affected Galaxy devices as soon as the OTA is available for the model.
Inventory devices still running pre-September 2026 patch levels and prioritize them for update through MDM.
Review paired PCs in Phone Link and remove any device that is not recognized or not currently authorized.

Patch Information

Samsung addressed the issue in the SMR Sep-2026 Release 1 security maintenance release. Details are published in the Samsung Mobile Security Update bulletin for September 2026. Device availability of the SMR varies by model and carrier.

Workarounds

Disable Link to Windows on Galaxy devices where the feature is not required for business use.
Unpair unused PCs from the Link to Windows configuration to reduce the set of reachable connection targets.
Restrict physical and console access to Galaxy devices in shared or kiosk deployments until the patch is applied.