# Samsung Mobile vulnerabilities & exploitation **CISA KEV** > As of 2026-11-13, Threadlinqs tracks 6 Samsung Mobile CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 3 tracked threat campaigns and 2 named threat actors. **Data as of:** 2026-11-13 ## Exploitation timeline Threadlinqs has recorded 6 Samsung Mobile CVEs published between 2025-09-15 and 2026-07-15. The busiest month was 2025-12 (2 new CVEs). 1 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Samsung Mobile CVEs. - [CVE-2025-21042](https://intel.threadlinqs.com/cve/CVE-2025-21042) — HIGH 8.8 · KEV · EPSS 35.6% · 2025-09-12 - [CVE-2025-21079](https://intel.threadlinqs.com/cve/CVE-2025-21079) — HIGH 7.1 · EPSS 0.6% · 2025-11-05 - [CVE-2025-58486](https://intel.threadlinqs.com/cve/CVE-2025-58486) — MEDIUM 4 · EPSS 0.2% · 2025-12-02 - [CVE-2026-21055](https://intel.threadlinqs.com/cve/CVE-2026-21055) — HIGH 8.5 · EPSS 0.2% · 2026-07-10 - [CVE-2025-58487](https://intel.threadlinqs.com/cve/CVE-2025-58487) — MEDIUM 4 · EPSS 0.2% · 2025-12-02 - [CVE-2026-20971](https://intel.threadlinqs.com/cve/CVE-2026-20971) — HIGH 7.8 · EPSS 0.1% · 2026-01-09 ## Products affected Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 4 distinct Samsung Mobile products are affected. The most frequently affected: - Devices — 2 CVEs - Samsung Account — 2 CVEs - Bixby — 1 CVE - Samsung Members — 1 CVE ## Threat activity 3 tracked threat campaigns reference Samsung Mobile products or exploit Samsung Mobile CVEs: - [Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate](https://intel.threadlinqs.com/threat/TL-2026-4043) — HIGH — 2026-10-21 - [Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487)](https://intel.threadlinqs.com/threat/TL-2026-1901) — CRITICAL — 2026-08-05 - [CVE-2026-20971: Eight-Year-Old Samsung Knox PROCA/FIVE Kernel Use-After-Free in /proc/pid/integrity Handlers](https://intel.threadlinqs.com/threat/TL-2026-0925) — HIGH — 2026-06-24 ## Threat actors targeting Samsung Mobile Named threat actors attributed to campaigns that involve Samsung Mobile products or CVEs, with the number of linked campaigns: - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 campaign - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 1 campaign ## How to prioritise Samsung Mobile patching This order follows the data Threadlinqs holds for Samsung Mobile, not a generic severity checklist: - 1 of 6 Samsung Mobile CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2025-21042](https://intel.threadlinqs.com/cve/CVE-2025-21042). - Outside KEV, the highest EPSS scores are [CVE-2025-21079](https://intel.threadlinqs.com/cve/CVE-2025-21079) (0.6%), [CVE-2025-58486](https://intel.threadlinqs.com/cve/CVE-2025-58486) (0.2%), [CVE-2026-21055](https://intel.threadlinqs.com/cve/CVE-2026-21055) (0.2%). - 0 CVEs score Critical and 4 High on CVSS v3 (maximum 8.8, average 6.7); sequence these after KEV and high-EPSS items. - 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-13 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/samsung-mobile All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs for threats exploiting Samsung Mobile products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp