Product by Fleetdm
Fleet Device Management Fleet
41 known vulnerabilities in Fleet Device Management Fleet (Fleetdm), 0 of them actively exploited (CISA KEV).
Key figures
41
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-34387 | Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts | 9.8 | |
| Critical | CVE-2020-26276 | SAML authentication vulnerability in Fleet | 10.0 | |
| High | CVE-2026-101045 | Fleet Homebrew Cask OS Command Injection via Metadata | 8.0 | |
| Critical | CVE-2026-26191 | Fleet vulnerable to OS command injection in software packages | 9.8 | |
| Critical | CVE-2026-103264 | Fleet before 4.87.0 Authentication Bypass via Device Identifiers | 9.1 | |
| High | CVE-2026-111924 | Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression | 7.5 | |
| High | CVE-2026-111923 | Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing | 7.5 | |
| High | CVE-2026-54245 | Fleet Device Management Fleet: SQL Injection | — | |
| Critical | CVE-2025-27509 | SAML authentication vulnerability due to improper SAML response validation | — | |
| High | CVE-2026-26061 | Fleet's unbounded request body read allows remote Denial of Service | 7.5 | |
| High | CVE-2026-26062 | Fleet server may terminate unexpectedly when handling certain gRPC requests | 6.5 | |
| Medium | CVE-2026-48786 | Fleet Device Management Fleet: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| High | CVE-2026-24899 | Fleet Windows MDM Azure AD JWT Authentication Bypass | 7.5 | |
| High | CVE-2026-26060 | Fleet: Password reset tokens remain valid after password change for 24 hours | 8.8 | |
| Medium | CVE-2026-101047 | Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs | 5.3 | |
| High | CVE-2026-26186 | Fleet has a SQL injection via backtick escape in ORDER BY parameter | 8.8 | |
| High | CVE-2026-34386 | Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin | 8.8 | |
| Critical | CVE-2026-23518 | Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment | 9.8 | |
| High | CVE-2026-29180 | Fleet's team maintainer can transfer hosts from any team via missing source team authorization | 8.8 | |
| Low | CVE-2021-21296 | Denial-of-service in Fleet | 2.7 | |
| Medium | CVE-2026-46371 | Fleet Device Management Fleet: SQL Injection | 6.5 | |
| Medium | CVE-2026-46370 | Fleet Device Management Fleet: SQL Injection | 6.5 | |
| Medium | CVE-2026-24000 | Fleet has a rate limiting bypass via untrusted client IP headers | 5.3 | |
| High | CVE-2022-24841 | Improper Authorization in github.com/fleetdm/fleet | 6.5 | |
| High | CVE-2026-23998 | Fleet has a Windows MDM management endpoint authentication bypass | 7.5 |