CVE-2026-27806

BRIEFING NOTE - CVE-2026-27806 OVERVIEW CVE-2026-27806 is a local privilege escalation vulnerability affecting Fleet, an open source device management platform, versions prior to 4.81.1. The vulnerability exists in the Orbit agent's FileVault disk encryption key rotation mechanism, which collects user passwords through a GUI dialog and insecurely interpolates them directly into a Tcl/expect script executed with root privileges. An attacker can inject arbitrary Tcl commands by including a closing brace character in their password, bypassing the intended script logic. SEVERITY The vulnerability carries a CVSS v3.1 score of 7.8 (HIGH) with a local attack vector requiring low complexity and low privileges to exploit. An unprivileged local user can escalate to root-level access without user interaction. The attack provides complete compromise potential, affecting confidentiality, integrity, and availability of the affected system. The EPSS score of 0.000140000 indicates relatively low statistical probability of exploitation in the wild compared to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and this vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is not currently listed on industry Hot Lists, suggesting minimal community attention or public exploit availability at this time. Organizations running Fleet prior to version 4.81.1 should prioritize patching to address this root privilege escalation risk.