CVE-2026-20992: 
NixOS vulnerability analysis and mitigation

CVE-2026-20992 is an improper authorization vulnerability in the Settings component of Samsung Android devices that allows a local attacker to disable the configuration of background data usage for applications. It affects Samsung Android versions 13, 14, 15, and 16 prior to the SMR Mar-2026 Release 1 patch. The vulnerability was published on March 16, 2026, and is classified under CWE-863 (Incorrect Authorization). It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Samsung Advisory).

The root cause is improper authorization (CWE-863) in the Samsung Settings component, where insufficient access controls allow a low-privileged local user to interact with background data usage configuration functionality that should be restricted. An attacker with local access and low privileges can invoke the vulnerable Settings functionality without proper authorization checks, effectively disabling the ability for legitimate users to configure application background data usage. No special user interaction or elevated privileges are required beyond basic local device access. No public proof-of-concept or detailed technical write-up has been identified at this time (Samsung Advisory).

Successful exploitation allows a local, low-privileged attacker to modify application background data usage settings without authorization, preventing legitimate users from managing data consumption controls for installed applications. The integrity impact is limited — no confidentiality or availability impact has been identified — but the manipulation could lead to unexpected data usage or prevent users from enforcing data restrictions on applications. The scope is confined to the affected device and does not enable lateral movement or remote code execution (Samsung Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2026-20992. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Samsung Advisory).

Samsung has released a fix in the SMR Mar-2026 Release 1 for Samsung Android versions 13, 14, 15, and 16. Users and administrators should apply the March 2026 Samsung security patch immediately to all affected devices. Organizations should also enforce device access controls to limit local access to trusted users, reducing the risk of exploitation prior to patching. No configuration-based workaround has been published by Samsung (Samsung Advisory).