Android: remote code execution and privilege escalation flaws fixed in November 2026 patch day update
CVE-2024-20125 CVE-2024-33044 CVE-2024-33056 CVE-2024-33063 CVE-2024-43048 CVE-2024-43052 CVE-2024-43077 CVE-2024-43097 CVE-2024-43701 CVE-2024-43762 CVE-2024-43764 CVE-2024-43767 CVE-2024-43768 CVE-2024-43769
Published 05/11/2026 20:51
Timeline
2 events over 13 d
- 23/10/2026 12:20ConfirmedBSI CERT-Bund (WID)+13 d
- 05/11/2026 20:51Published on WatchtowerPro CISO
In short
Google released its November 2026 Android security update, and Samsung fixed the flaws relevant to its mobile devices. The flaws allow remote code execution and privilege escalation. No active exploitation is known. Install the latest Android security update on all devices.
How bad is it
High: a remote attacker could run code or gain higher privileges on an unpatched device; no active exploitation is known.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 14 CVEs · CVSS 3.1 from NVD, from the vendor, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
What to do now
- Install the latest Android security update on all managed devices as soon as the manufacturer offers it.
- For Samsung devices, apply the Samsung Mobile security update.
- Check the device's security patch level in Settings and confirm it shows the November 2026 level or later.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Google Android, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [hoch] Android Patchday Dezember 2024: Mehrere Schwachstellen CERT · [UPDATE] [hoch] Android Patchday November 2024 CERT · [UPDATE] [hoch] Android Patchday September 2026: Mehrere Schwachstellen CERT