What’s Vulnerable › Vulnerabilities
CVE-2026-34391: Fleet Vulnerable to Windows MDM cross-device command disclosure
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-27 · updated 2026-10-26
- Weakness: CWE-488
Description
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.
Affected products
- fleetdm fleet: before 4.81.1 — fixed in 4.81.1
How to fix
Upgrade to a fixed version: fleetdm fleet 4.81.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-34391 or the next vulnerability affects your stack