MEDIUM🇬🇧 English

CVE-2026-34391

CVSS 6.6v4.0pub. 2026-03-27upd. 2026-04-02

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Fleetdm Fleet

    APP
    Fleetdm
    < 4.81.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
VPN
CWE
Referencje

Powiązane podatności

CVE-2026-23518CRITICAL9.3PL ✓ten sam produkt

Brak weryfikacji podpisu JWT w Fleet Windows MDM — nieautoryzowana rejestracja urządzeń

CVE-2020-26276CRITICAL10.0ten sam produkt

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library...

CVE-2026-24899HIGH8.2ten sam produkt

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows M...

CVE-2026-23998HIGH8.2ten sam produkt

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows M...

CVE-2026-26062HIGH8.7ten sam produkt

Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service ...