# CVE-2026-21086: Samsung ProxyHandler improper authorization in SMR Aug-2026

Source: https://junglewise.ai/threats/cve-2026-21086-samsung-proxyhandler-improper-authorization-in-smr-aug-2026  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-21086 · Severity: info · Published 2026-09-09

Samsung devices contain a ProxyHandler component that improperly checks permissions on proxy configuration settings. A local attacker with access to the device can read the proxy configuration without proper authorization, potentially exposing network routing details or credentials embedded in proxy settings.

Technologies: [Samsung Mobile Firmware](https://junglewise.ai/threats/technologies/mobile-firmware). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-21086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21086 being exploited in the wild.

**How severe is CVE-2026-21086?** Informational severity, published 9 September 2026.

**Which products and versions are affected?** Samsung Mobile Firmware prior to SMR Aug-2026 Release 1.

**Is there a fix for CVE-2026-21086?** A patch was published on 2026-08: SMR Aug-2026 Release 1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21086 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-21086?** Check whether you run Samsung Mobile Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability exists in Samsung's ProxyHandler component affecting firmware versions prior to SMR (Samsung Mobile Release) Aug-2026 Release 1. The vulnerability allows a local attacker with device access to bypass authorization checks and read proxy configuration details. The attack requires local access to the affected device; network-based exploitation is not possible. An attacker can access sensitive proxy settings that may include network configuration or embedded credentials. The vulnerability is patched in Samsung's August 2026 mobile security release.

## Affected products

- Samsung Mobile Firmware prior to SMR Aug-2026 Release 1

## Timeline

- 2026-09-09: disclosed
- 2026-08: patched: SMR Aug-2026 Release 1

## References

- [https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09](https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09)

## Related threats

- [Samsung libsimba.heifdec.media buffer overflow in cover image processing](https://junglewise.ai/threats/cve-2026-21126-improper-input-validation-in-getting-cover-image-in-libsimba)
- [Samsung libril_sem stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-21068-samsung-libril-sem-stack-based-buffer-overflow)
- [Samsung libcodec2_sec_flacdec out-of-bounds write](https://junglewise.ai/threats/cve-2026-21066-samsung-libcodec2-sec-flacdec-out-of-bounds-write)