7.8

CVE-2026-28647

EPSS 0.08%
Veröffentlicht 05.10.2026 18:39:21
Zuletzt bearbeitet 07.10.2026 13:07:56
Erkennungen
Login

In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version 14.0

Google ≫ Android Version 15.0

Google ≫ Android Version 16.0 Update qpr2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.08%	0.001

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-28647

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-28647

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-28647

EUVD