CVE-2026-34391CWE-488

Fleet Vulnerable to Windows MDM cross-device command disclosure

Medium · published March 27, 2026

CVSS v4.0
6.6
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.

The record
Technical detail
CVSS v4.0
6.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00263 · 17.2th percentile
Weakness
CWE-488 · Exposure of Data Element to Wrong Session
Published
2026-03-27T19:19Z
EPSS history
Timeline
  • 27 MAR 19:19Z
    Fleet Vulnerable to Windows MDM cross-device command disclosure
    cvelistv5