CVE-2026-21134
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-287
Impact
Adjacent attackers on the same local network can access sensitive information without authentication. They need network adjacency to the target device running the application.
Root cause
Improper authentication (CWE-287) in the application enables unauthorized access from nearby network actors.
Affected systems
Samsung Flow prior to version 4.9.22.4
CVSS v4.0 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Samsung Flow to version 4.9.22.4 or later via the Galaxy Store or Google Play Store. If unable to update immediately, disconnect from untrusted local networks or disable the Samsung Flow service.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.