Vendor dossier / #18
Samsung vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 15 Samsung vulnerabilities as of catalog 2026.09.23, 0.9% of all 1,721 entries and rank 18 of 283 vendors. The first was added on 2022-11-08 and the most recent on 2026-04-24; 0 are flagged as used in ransomware campaigns.
- KEV entries
- 150.9% of catalog
- Last 90 days
- +0added
- Ransomware: known
- 00%
- Products
- 2distinct
- First added
- 2022-11-08
- Latest added
- 2026-04-24
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 0 |
| 2022 | 3 |
| 2023 | 8 |
| 2024 | 0 |
| 2025 | 3 |
| 2026 | 1 |
QCommon questions
How many Samsung vulnerabilities are in CISA KEV?
15, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.9% of the catalog.
Which Samsung product has the most KEV entries?
Mobile Devices, with 13 entries. 2 products appear in total.
How many Samsung KEV vulnerabilities are linked to ransomware?
0 of 15 (0%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Samsung vulnerability added to KEV?
2026-04-24 (CVE-2024-7399).
What is the most common weakness in Samsung KEV entries?
CWE-787 (Out-of-bounds write), listed on 3 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Mobile Devices | 13 | 86.7% |
| MagicINFO 9 Server | 2 | 13.3% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-787 Out-of-bounds write | 3 | 20% |
| CWE-22 Path traversal | 2 | 13.3% |
| CWE-416 Use after free | 2 | 13.3% |
| CWE-434 Unrestricted file upload | 1 | 6.7% |
| CWE-703 | 1 | 6.7% |
| CWE-20 Improper input validation | 1 | 6.7% |
| CWE-125 Out-of-bounds read | 1 | 6.7% |
| CWE-362 Race condition | 1 | 6.7% |
| CWE-912 | 1 | 6.7% |
| CWE-532 | 1 | 6.7% |
| CWE-200 Information exposure | 1 | 6.7% |
| CWE-269 Improper privilege management | 1 | 6.7% |
EAll 15 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2024-7399 | MagicINFO 9 Server | Samsung MagicINFO 9 Server Path Traversal Vulnerability | Unknown | CWE-22, CWE-434 | ||
| CVE-2025-21042 | Mobile Devices | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2025-21043 | Mobile Devices | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2025-4632 | MagicINFO 9 Server | Samsung MagicINFO 9 Server Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2022-22265 | Mobile Devices | Samsung Mobile Devices Use-After-Free Vulnerability | Unknown | CWE-703 | ||
| CVE-2021-25489 | Mobile Devices | Samsung Mobile Devices Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-25487 | Mobile Devices | Samsung Mobile Devices Out-of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2021-25395 | Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | Unknown | CWE-362 | ||
| CVE-2021-25394 | Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-25372 | Mobile Devices | Samsung Mobile Devices Improper Boundary Check Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-25371 | Mobile Devices | Samsung Mobile Devices Unspecified Vulnerability | Unknown | CWE-912 | ||
| CVE-2023-21492 | Mobile Devices | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability | Unknown | CWE-532 | ||
| CVE-2021-25370 | Mobile Devices | Samsung Mobile Devices Memory Corruption Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-25369 | Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | Unknown | CWE-200 | ||
| CVE-2021-25337 | Mobile Devices | Samsung Mobile Devices Improper Access Control Vulnerability | Unknown | CWE-269 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 15 Samsung vulnerabilities (0.9% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/samsung/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Samsung beyond this data.