CVE-2026-20978: Authorization Bypass in KnoxGuardManager

Successful exploitation of CVE-2026-20978 allows a local attacker to bypass the intended persistence configuration of applications managed by KnoxGuardManager. This could lead to unauthorized access to sensitive data, modification of application behavior, or even the execution of malicious code within the application's context. The attacker needs physical access to the device to exploit this vulnerability. The blast radius is limited to the affected application and the device itself, as it requires local access.

1. Reserved2025-12-11
2. Published2026-02-04
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-20978 is to upgrade to the SMR February 2026 release or later, specifically version 2026.0.1 or higher. If immediate upgrading is not feasible, consider implementing stricter access controls and application sandboxing to limit the potential impact of a successful attack. Monitor device logs for any unusual activity related to KnoxGuardManager or application persistence settings. While a direct detection signature is unlikely, monitoring for unauthorized modifications to application data directories could be indicative of exploitation.