CVE-2026-21039

MediumCVSS 6.9

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.

Risk Assessment

The risk is that an attacker with local access can disable or weaken theft protection features, increasing vulnerability to unauthorized access and data theft.

Recommendation

It is recommended to immediately update the system to SMR Jul-2026 Release 1 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Settings

CVE-2026-28648High
In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original NVD description (English source)

Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS