CVE-2026-20980: 
NixOS vulnerability analysis and mitigation

CVE-2026-20980 is an improper input validation vulnerability in Samsung's PACM (Platform for Access Control Module) component that allows a physical attacker to execute arbitrary commands on affected devices. It affects Samsung Android versions 14, 15, and 16 prior to the SMR Feb-2026 Release 1 security update. The vulnerability was published on February 4, 2026, with the patch released on February 5, 2026. It carries a CVSS v3.1 base score of 6.8 (Medium) and a CVSS v4.0 base score of 7.0 (High) (Samsung Security).

The vulnerability is rooted in improper input validation (CWE-20) within the PACM (Platform for Access Control Module) component of Samsung Android. An attacker with physical access to the device can supply maliciously crafted input to PACM, bypassing validation checks and triggering arbitrary command execution. No user interaction or elevated privileges are required for exploitation, and the attack complexity is low. No detailed public technical write-up or proof-of-concept code was available at the time of disclosure (Samsung Security).

Successful exploitation allows a physical attacker to execute arbitrary commands on the affected Samsung device, resulting in a full compromise of confidentiality, integrity, and availability. An attacker could access sensitive user data, modify system configurations or files, and disrupt device operation. Because physical access is required, the scope of impact is limited to the individual device rather than enabling network-based lateral movement (Samsung Security).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure (Samsung Security). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013%, reflecting a very low probability of exploitation in the near term. Exploitation is constrained by the requirement for physical device access, significantly limiting the attacker pool.

Samsung released the SMR Feb-2026 Release 1 security update on February 5, 2026, which addresses this vulnerability for Android 14, 15, and 16. Users and administrators should apply this update immediately via the device's Software Update menu or through enterprise mobile device management (MDM) solutions. In the interim, enforcing strict physical security controls to prevent unauthorized access to Samsung devices is recommended as a compensating measure (Samsung Security).

Coverage of CVE-2026-20980 has been limited to vulnerability aggregation sites and automated security feeds, with no notable independent researcher commentary or significant social media discussion identified. A brief post on SammyFans noted the February 2026 Samsung security update and its patches (Samsung Security).