CVE-2026-22808CWE-79

Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Medium · published January 21, 2026

CVSS v4.0
5.5
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-21T21:18Z
EPSS history
Timeline
  • 21 JAN 21:18Z
    Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
    cvelistv5