Exploitation timeline
Threadlinqs has recorded 6 Samsung Mobile CVEs published between and . The busiest month was 2025-12 (2 new CVEs). 1 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Samsung Mobile CVEs.
- CVE-2025-21042high 8.8KEVEPSS 35.6%
- CVE-2025-21079high 7.1EPSS 0.6%
- CVE-2025-58486medium 4EPSS 0.2%
- CVE-2026-21055high 8.5EPSS 0.2%
- CVE-2025-58487medium 4EPSS 0.2%
- CVE-2026-20971high 7.8EPSS 0.1%
Products affected
Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 4 distinct Samsung Mobile products are affected. The most frequently affected:
- Devices 2 CVEs
- Samsung Account 2 CVEs
- Bixby 1 CVE
- Samsung Members 1 CVE
Threat activity
3 tracked threat campaigns reference Samsung Mobile products or exploit Samsung Mobile CVEs:
- Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware DominateHIGH
- Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487)CRITICAL
- CVE-2026-20971: Eight-Year-Old Samsung Knox PROCA/FIVE Kernel Use-After-Free in /proc/pid/integrity HandlersHIGH
Threat actors targeting Samsung Mobile
Named threat actors attributed to campaigns that involve Samsung Mobile products or CVEs, with the number of linked campaigns:
How to prioritise Samsung Mobile patching
This order follows the data Threadlinqs holds for Samsung Mobile, not a generic severity checklist:
- 1 of 6 Samsung Mobile CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2025-21042.
- Outside KEV, the highest EPSS scores are CVE-2025-21079 (0.6%), CVE-2025-58486 (0.2%), CVE-2026-21055 (0.2%).
- 0 CVEs score Critical and 4 High on CVSS v3 (maximum 8.8, average 6.7); sequence these after KEV and high-EPSS items.
- 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-13 and refresh daily.