PT-2026-28628 · Jetbrains · Fleet

Prateek-0490 · Publicado 2026-03-27 · Atualizado 2026-05-14 · CVE-2026-34387

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.1

Description Fleet is open source device management software susceptible to a command injection issue within its software installer pipeline. This allows an attacker to execute arbitrary code as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a specifically crafted software package. The issue resides in the uninstall scripts processing crafted software package metadata.

Recommendations Update to version 4.81.1 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-34387

GHSA-7RHW-5MPV-GP4H

Produtos afetados

Fleet

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34387.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-7rhw-5mpv-gp4h · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2037606708357259673 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34387 · Aviso do Fabricante
• https://twitter.com/dailycve/status/2054944195438129617 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34387 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037719430680223888 · Publicação no Twitter