CVE-2026-21023

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Apr 29, 2026

CISA due date

—

The record

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

Affected packages

Ecosystem	Package	Introduced	Fixed