CVE-2026-26060

CVE-2026-26060 is a high-severity vulnerability affecting Fleet, an open-source device management software, in versions prior to 4.81.0. This flaw allows previously issued password reset tokens to remain valid even after a user changes their password, enabling an attacker to reuse a stale token to reset an account. With a CVSS score of 8.8 (High), this vulnerability has a network attack vector and low attack complexity, potentially leading to high impacts on confidentiality, integrity, and availability of affected accounts. There is currently no evidence of active exploitation, nor are public exploit modules available. Community discussion is minimal, and the EPSS score indicates a very low probability of exploitation.