CVE-2026-21086 is an improper authorization flaw in ProxyHandler on Samsung Android devices. The CVE record scores it 7.8 (High) and says it lets a local attacker access proxy configuration. Samsung's September 2026 bulletin lists the fix in SMR Sep-2026 Release 1, so install that update.
What's affected
Samsung's September 2026 bulletin lists the ProxyHandler issue (SVE-2026-1660) as affecting Android 14, 15, 16 and 17 on Samsung devices, fixed in SMR Sep-2026 Release 1.
Source conflict to note: the CVE record scores this 7.8 (High) and its text says fixed in SMR Aug-2026 Release 1, while Samsung's September 2026 bulletin rates it Moderate and lists SMR Sep-2026 Release 1. Both are reported here; patch to the later release to be covered either way.
Weakness class: CWE-20.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and read the Android security patch level. Samsung ships these fixes in the Samsung Mobile Security Maintenance Release (SMR) named in the bulletin, so a September 2026 patch level or later is the thing to look for. If you manage a fleet, your mobile device management console can report the patch level and Android version per device.
The bulletin lists Android 14, 15, 16 and 17 as affected, so any current Samsung device on those versions that has not taken the September 2026 SMR should be treated as exposed. Samsung does not publish a per-model table on the page, so check the update status on the device itself rather than assuming from the model name.
What to do now
- Install the September 2026 Samsung security update (SMR Sep-2026 Release 1) on every managed Samsung device. Carriers sometimes roll it out later than Samsung, so confirm on the device.
- If you use a proxy or per-app VPN on enrolled devices, review whether the proxy settings on a handful of devices match what your MDM pushed. A mismatch on an unpatched device is worth a closer look.
- Report the patch level in your MDM inventory and set a compliance rule that flags devices more than one SMR behind.
- Keep the Samsung bulletin as your source of truth, and re-read it, because the vendor updated its vulnerability list after first publication.
Why it matters
ProxyHandler holds the device's proxy configuration. Proxy settings can reveal internal hostnames, and on managed devices they can point traffic at a corporate gateway. If a local app can read or change them without proper authorization, it can learn about the network the device sits on, and in the worst case influence where traffic goes.
The record maps this to CWE-20, improper input validation, which is a broad class. Samsung's own wording is improper authorization, so the practical lesson is that a system service answered a caller it should have checked first.
The attack vector in the record is local, with low complexity and low privileges required and no user interaction. That means the attacker needs code already running on the device, for example a malicious or compromised app. Local flaws still matter on phones, because the app sandbox is the main wall between one app and the rest of the device, and a bug in a system component can let one app reach beyond it.
The CISA Known Exploited Vulnerabilities flag is false in the record, and the Samsung bulletin we read does not describe exploitation. Treat this as a patch in the normal monthly cycle, not an emergency, but do not let it sit for months.
Quick check
Does this need a malicious link or a remote attacker?
No. The record gives a local attack vector with no user interaction, so the attacker needs code running on the device first.
Which fix do I need?
Samsung's bulletin lists SMR Sep-2026 Release 1. Note that the CVE record text mentions SMR Aug-2026 Release 1, so use the vendor bulletin and confirm the patch level on the device.
Sources
Last reviewed: 18 October 2026.
