# CVE-2026-125715: Samsung mTower access control bypass in TA sessions

Source: https://junglewise.ai/threats/cve-2026-125715-samsung-mtower-lacks-access-control-for-ta-sessions-allowing-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125715 · Severity: medium · CVSS 5.3 · Published 2026-11-10

Samsung mTower is a trusted execution environment (TEE) for mobile devices that isolates sensitive operations from the main operating system. A Normal World application can bypass access controls to open trusted application (TA) sessions and invoke commands, potentially gaining unauthorized access to sensitive functionality depending on which TAs are exploited.

Technologies: [Samsung mTower](https://junglewise.ai/threats/technologies/mtower). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-125715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125715 being exploited in the wild.

**How severe is CVE-2026-125715?** Medium severity, with a CVSS score of 5.3, published 10 November 2026.

**Which products and versions are affected?** Samsung mTower.

**Is there a fix for CVE-2026-125715?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125715 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-125715?** Check whether you run Samsung mTower. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An access control vulnerability in Samsung mTower fails to properly validate client identity before allowing a Normal World application to open TA sessions or close existing sessions if their identifiers are known. The vulnerability is a missing or insufficient authorization check on session operations, allowing arbitrary applications to invoke TA commands. A fix enforces per-TA access control lists (ACLs) and client identity verification on session open.

## Affected products

- Samsung mTower

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/Samsung/mTower/commit/97070d65ac63713b188b6e2d6bb7076d95100429](https://github.com/Samsung/mTower/commit/97070d65ac63713b188b6e2d6bb7076d95100429)

## Related threats

- [Samsung mTower untrusted pointer dereference in syscalls](https://junglewise.ai/threats/cve-2026-10420-samsung-mtower-untrusted-pointer-dereference-in-syscalls)
- [Samsung mTower untrusted pointer dereference in secure-world boundary](https://junglewise.ai/threats/cve-2026-82927-samsung-mtower-untrusted-pointer-dereference-in-secure-world)
- [Samsung mTower NULL pointer dereference in TEE invoke](https://junglewise.ai/threats/cve-2026-82926-samsung-mtower-null-pointer-dereference-in-tee-invoke)