CVE-2026-21094 is an improper input validation flaw in wpa_supplicant on Samsung Android devices. The record scores it 8.8 (High) and says an adjacent attacker can write out-of-bounds memory without privileges or user interaction. Samsung rates it High and lists the fix in SMR Sep-2026 Release 1.
What's affected
Samsung's September 2026 bulletin lists the wpa_supplicant issue (SVE-2026-3217) as affecting Android 14, 15, 16 and 17 on Samsung devices, fixed in SMR Sep-2026 Release 1.
Here the sources agree on severity: the record scores 8.8 (High) and Samsung rates it High.
Weakness class: CWE-20.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and read the Android security patch level. Samsung ships these fixes in the Samsung Mobile Security Maintenance Release (SMR) named in the bulletin, so a September 2026 patch level or later is the thing to look for. If you manage a fleet, your mobile device management console can report the patch level and Android version per device.
The bulletin lists Android 14, 15, 16 and 17 as affected, so any current Samsung device on those versions that has not taken the September 2026 SMR should be treated as exposed. Samsung does not publish a per-model table on the page, so check the update status on the device itself rather than assuming from the model name.
What to do now
- Install the September 2026 Samsung security update (SMR Sep-2026 Release 1) on every managed Samsung device. Carriers sometimes roll it out later than Samsung, so confirm on the device.
- In the meantime, staff who travel can avoid joining unknown open networks, but that only narrows exposure. The September update is the fix.
- Report the patch level in your MDM inventory and set a compliance rule that flags devices more than one SMR behind.
- Keep the Samsung bulletin as your source of truth, and re-read it, because the vendor updated its vulnerability list after first publication.
Why it matters
wpa_supplicant is the component that handles Wi-Fi authentication and association on Android. Its attack surface is wider than most of this month's Samsung items because the record's vector is adjacent, with no privileges and no user interaction. Adjacent means the attacker must be on the same network segment or within wireless range, not that they need a foothold on the device.
That makes this the Samsung item to patch first. Input validation failures in a network-facing parser lead to memory corruption (CWE-20 is the class named in the record), and the record rates confidentiality, integrity and availability impact as high.
The record's KEV flag is false and the bulletin does not describe exploitation. Still, a flaw reachable from nearby wireless range deserves a short deadline.
Quick check
Why is this one rated higher than the others?
Its vector is adjacent with no privileges and no user interaction, so an attacker does not need code on the device first. Samsung also rates it High.
Does this affect every Wi-Fi network?
The sources do not say which network types or conditions are needed. Treat all Wi-Fi use on unpatched devices as in scope.
Sources
Last reviewed: 18 October 2026.
