CVE-2026-0073
📛 CVE Title
CVE-2026-0073
Description
In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- google_android
- CVSS severity
- high
- CVSS score
- 8.8 / 10
- CVSS vector
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.8 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- 2025-10-15
- Published
- 2026-05-04 18:00 UTC
- Last updated
- 2026-05-05 03:56 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0073.json
- Linked Threat
- CVE-2026-0073 — CVE-2026-0073
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-04 18:16:26 UTC
- NVD last modified
- 2026-05-05 19:54:49 UTC
- NVD CVSS v3.1
- 8.8 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0001 (probability of exploitation in next 30 days)
- EPSS percentile
- 1.21% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-303
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 04:50 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-27041 - Assigner
- google_android
- Published
- May 4, 2026, 6:00:10 PM
- Updated
- May 5, 2026, 3:56:34 AM
- EUVD base score (CVSS 3.1)
-
8.8 / 10
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0100
- Vendors
- Products
-
Android (14)Android (15)Android (16)Android (16-qpr2)
ENISA description: In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Android |
16-qpr2 (affected),
16 (affected),
15 (affected),
14 (affected)
|
— |
Affected products — CPE 2.3 (6) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-0073 tenable:nvd.nist.gov
- https://securityaffairs.com/191710/breaking-news/critical-android-vulnerability-cve-2026-0073-fixed-by-google.html tenable:securityaffairs.com
- https://source.android.com/docs/security/bulletin/2026/2026-05-01 tenable:source.android.com
- https://www.cve.org/CVERecord?id=CVE-2026-0073 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
- https://www.securityweek.com/critical-remote-code-execution-vulnerability-patched-in-android-2/ tenable:www.securityweek.com
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://source.android.com/docs/security/bulletin/2026/2026-05-01 security@android.com Vendor Advisory
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:cybernews.com
Google is urging Android users to update now after discovering a critical flaw that could allow attackers to compromise their devices without needing extra permissions or user interaction. The bug, tracked as CVE-2026-0073 , has been patched in Google's latest security update.
2026-05-23 21:34 UTC -
web:cyberpress.org
Organizations managing Android fleets should prioritize patch deployment and ensure that devices are running supported Android versions with active security updates. Keeping devices updated remains the most effective defense against zero-click and remote exploitation threats like CVE-2026-0073 .
2026-05-23 21:34 UTC -
web:darkwebinformer.com
CVE-2026-0073 is an authentication bypass vulnerability in the adbd_tls_verify_cert function of Android's auth.cpp. This function is responsible for verifying the TLS certificate presented by a connecting host during the wireless ADB pairing and connection flow introduced in Android 11.
2026-05-23 21:34 UTC -
web:nvd.nist.gov
This is a potential security issue, you are being redirected to https://nvd.nist.gov
2026-05-23 21:34 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 21:34 UTC -
web:securityaffairs.com
Google patched a critical Android flaw ( CVE‑2026‑0073 ) that lets attackers run code remotely without user action. Google released a security update for Android to address a critical remote code execution flaw, tracked as CVE‑2026‑0073 , in the System component. The bug allowed attackers to run code as the shell user without needing extra permissions, or any user interaction. The patch ...
2026-05-23 21:34 UTC -
web:www.anavem.com
Immediate Mitigation Steps for CVE-2026-0073 Protection Android users must immediately install the May 2026 Android Security Bulletin updates to protect against CVE-2026-0073 exploitation attempts. Google Pixel device owners can access these critical security patches through Settings > System > System update, where the May 2026 security patch should appear as available for download. Samsung ...
2026-05-23 21:34 UTC -
web:www.forbes.com
Google has confirmed that a critical Android vulnerability, CVE-2026-0073 , could enable remote code execution without any user interaction required.
2026-05-23 21:34 UTC -
web:www.securityweek.com
Google announced on Monday the release of an Android update patching a critical vulnerability that can be exploited for remote code execution.
2026-05-23 21:34 UTC -
web:www.sentinelone.com
CVE-2026-0073 is an authentication bypass vulnerability in Google Android. Learn about its impact, affected versions, and mitigation methods.
2026-05-23 21:34 UTC -
web:cybersecuritynews.com
Microsoft released its March 2026 Patch Tuesday security update on March 10, 2026 , addressing 78 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, and .NET. The update includes one actively exploited zero-day vulnerability and multiple Critical-rated flaws demanding immediate attention from security teams. The most urgent fix this month is CVE - 2026 -21262, the sole zero-day ...
2026-06-03 07:48 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-06-03 07:48 UTC -
web:themobilehunt.com
Samsung has started pushing out its May 2026 security update to Galaxy devices, and this one carries more urgency than a typical monthly patch . It includes a fix for a critical zero-click Android vulnerability that lets attackers run code on your device without you doing anything at all. What makes this vulnerability so serious? The flaw, tracked as CVE-2026-0073 , was identified by Google and ...
2026-06-03 07:48 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.
2026-06-03 07:48 UTC -
web:www.crowdstrike.com
Microsoft's March 2026 Patch Tuesday addresses 82 CVEs , featuring eight Critical vulnerabilities.
2026-06-03 07:48 UTC -
web:www.rapid7.com
Microsoft is publishing 77 vulnerabilities this Patch Tuesday, including two publicly disclosed zero-day vulnerabilities.
2026-06-03 07:48 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-0073.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-0073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect Implementation of Authentication Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T03:56:34.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ovi (@0x0v1 + Barghest.asia)"
}
],
"datePublic": "2026-05-04T18:03:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.</p>"
}
],
"value": "In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote code execution",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T18:07:33.718Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://source.android.com/docs/security/bulletin/2026/2026-05-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-0073",
"datePublished": "2026-05-04T18:00:10.613Z",
"dateReserved": "2025-10-15T15:40:58.386Z",
"dateUpdated": "2026-05-05T03:56:34.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}