MEDIUM🇵🇱 Wersja polska

CVE-2026-34391

CVSS 6.6v4.0pub. 2026-03-27upd. 2026-04-02

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Fleetdm Fleet

    APP
    Fleetdm
    < 4.81.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
VPN
CWE
References

Related vulnerabilities

CVE-2026-23518CRITICAL9.3PL ✓ten sam produkt

Brak weryfikacji podpisu JWT w Fleet Windows MDM — nieautoryzowana rejestracja urządzeń

CVE-2020-26276CRITICAL10.0ten sam produkt

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library...

CVE-2026-24899HIGH8.2ten sam produkt

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows M...

CVE-2026-23998HIGH8.2ten sam produkt

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows M...

CVE-2026-26062HIGH8.7ten sam produkt

Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service ...