Fleet

Vendor:

First CVE: Dec 17, 2020 · Active for 5 years

28
Total CVEs
More Total CVEs than 96% of tracked products
7.0
Avg CVEs / Year
Higher CVE frequency than 92% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Fleet over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 17, 2020
5 years ago
Most Recent CVE
May 14, 2026
71 days ago

CVE Severity & Scoring

Fleet28 CVEs
All CVEs352,231 CVEs
LowMediumHighCritical
Attack Vector
Local2 (7.1%)
Network26 (92.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low28 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None27 (96.4%)
Unknown0 (0.0%)
Required1 (3.6%)
Privileges Required
Low14 (50.0%)
High2 (7.1%)
None12 (42.9%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (28 CVEs).

28 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2026-26191CRITICAL
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute a
May 14, 20269.832NONO
CVE-2026-34387CRITICAL
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary c
Mar 27, 20269.832NONO
CVE-2026-23518CRITICAL
Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow
Jan 21, 20269.832NONO
CVE-2026-26060HIGH
Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain
Mar 27, 20268.829NONO
CVE-2026-23998HIGH
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without pr
May 14, 20267.528NONO
CVE-2026-34386HIGH
Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Tea
Mar 27, 20268.828NONO
CVE-2026-29180HIGH
Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from
Mar 27, 20268.828NONO
CVE-2026-26186HIGH
Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `
Feb 26, 20268.828NONO
CVE-2026-27806HIGH
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog
Apr 8, 20267.827NONO
CVE-2026-46356HIGH
Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limitin
May 14, 20267.526NONO
View all 28 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (28 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (28 CVEs).

Media Mentions

Signals from CVEs in this product scope (28 CVEs).

Top CNAs Publishing CVEs For Fleet

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
4.77.037.80.2%00