CVE-2026-103264GHSA-vrc8-2wcx-327f
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
fleetdm fleet
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.87.0fleetCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Text from CVE List
Affected versions 2
- fleetaffected: all versions before 4.87.0CVE List
- fleetunaffected: 4.87.0CVE List