What’s Vulnerable › Products
fleetdm fleet vulnerabilities
41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 37 published in the last 12 months.
Check whether your fleetdm fleet version is affected
Latest fleetdm fleet vulnerabilities
- CVE-2026-111924 — Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression (CVSS 7.5)
- CVE-2026-111923 — Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing (CVSS 7.5)
- CVE-2026-103265 — Fleet before 4.89.0 Information Disclosure via MDM Command Results (CVSS 4.3)
- CVE-2026-103264 — Fleet before 4.87.0 Authentication Bypass via Device Identifiers (CVSS 9.1)
- CVE-2026-101047 — Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs (CVSS 5.3)
- CVE-2026-101046 — Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints (CVSS 4.3)
- CVE-2026-101045 — Fleet Homebrew Cask OS Command Injection via Metadata (CVSS 8.0)
- CVE-2026-54245 — Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database (CVSS 7.6)
- CVE-2026-46371 — Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint (CVSS 6.5)
- CVE-2026-46370 — Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint (CVSS 6.5)
- CVE-2026-48786 — Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (CVSS 6.5)
- CVE-2026-41262 — Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint (CVSS 4.3)
- CVE-2026-46356 — Fleet: IP spoofing allows bypassing API rate limiting (CVSS 7.5)
- CVE-2026-26191 — Fleet vulnerable to OS command injection in software packages (CVSS 9.8)
- CVE-2026-26062 — Fleet server may terminate unexpectedly when handling certain gRPC requests (CVSS 6.5)
- CVE-2026-24899 — Fleet Windows MDM Azure AD JWT Authentication Bypass (CVSS 7.5)
- CVE-2026-24000 — Fleet has a rate limiting bypass via untrusted client IP headers (CVSS 5.3)
- CVE-2026-23998 — Fleet has a Windows MDM management endpoint authentication bypass (CVSS 7.5)
- CVE-2026-27806 — Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit (CVSS 7.8)
- CVE-2026-34391 — Fleet Vulnerable to Windows MDM cross-device command disclosure (CVSS 7.5)
- CVE-2026-34389 — Fleet's user account creation via invite does not enforce invited email address (CVSS 6.5)
- CVE-2026-34388 — Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint (CVSS 7.5)
- CVE-2026-34387 — Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts (CVSS 9.8)
- CVE-2026-34386 — Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin (CVSS 8.8)
- CVE-2026-34385 — Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database (CVSS 8.1)