CVE-2026-20998 is a critical improper authentication flaw (CVSS 9.8) in Samsung Smart Switch before version 3.7.69.15. Remote attackers could bypass authentication without valid credentials. It is a companion to CVE-2026-20997. Samsung fixed it in 3.7.69.15, so update Smart Switch to that version or later.
What's affected
The record names Samsung Smart Switch versions before 3.7.69.15. The record carries no weakness identifier, so there is no CWE page to link, and the class is plain improper authentication. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The record was published with CVE-2026-20997, which describes improper verification of a cryptographic signature in the same versions. Both were part of the March 2026 Samsung bulletin. I could load the bulletin page, but it did not show the CVE text, so I am relying on the NVD record for the details.
The record does not mark this as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Open Smart Switch and read the version from the about or settings screen. Anything below 3.7.69.15 is affected. For a fleet, run a software inventory query for the application and its version, and look for copies on machines that no longer see regular use.
What to do now
- Update Smart Switch to 3.7.69.15 or later.
- Remove the application from machines that do not need it.
- Check CVE-2026-20997 as well. The same update fixes both records.
- Keep a record of the version on each machine so the next advisory takes minutes to answer.
- Download updates from Samsung only.
Why it matters
Authentication is the step that decides whether the caller is who they claim to be. A flaw there is among the most serious kinds, because everything after it assumes that the decision was right. The score of 9.8 follows from that: network reachable, no login and full impact on confidentiality, integrity and availability.
The record is short and does not describe the mechanism. That is typical of vendor bulletins, which tell you what to update and not how the bug works. In that situation the patch is the control, and the work is finding every copy of the software.
Quick check
Do I need to patch both CVE-2026-20997 and CVE-2026-20998 separately?
No. Both are fixed in Smart Switch 3.7.69.15, so a single update covers them.
Sources
Last reviewed: 19 October 2026.
