CVE-2026-103264

critical · 9.3

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

9.3

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-10-01

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-287

References

https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f
https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-103264