PT-2026-22115 · Fleet · Fleet

Secfox-Ai · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-24004

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1

Description Fleet is open source device management software. A flaw in the Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet management. An attacker could send a crafted request to the Android Pub/Sub endpoint to unenroll a targeted Android device from Fleet without authentication. The impact is limited to disruption of Android device management for the affected device.

Recommendations Versions prior to 4.80.1 should be upgraded to version 4.80.1. As a temporary workaround, consider disabling Android MDM if an immediate upgrade is not possible.

Exploit

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

CVE-2026-24004

GHSA-9PM7-6G36-6J78

GO-2026-4563

SUSE-SU-2026:1042-1

Affected Products

Fleet

References · 138

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24004.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9pm7-6g36-6j78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24004 · Security Note
• https://osv.dev/vulnerability/GO-2026-4563 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24004 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/commit/24dd2257ae7127680a2f6cd1a4eee58a9c95dd34 · Note
• https://suse.com/security/cve/CVE-2026-28683 · Note
• https://suse.com/security/cve/CVE-2026-27819 · Note
• https://t.me/CVEtracker/45822 · Telegram Post
• https://suse.com/security/cve/CVE-2026-32319 · Note
• https://suse.com/security/cve/CVE-2026-29193 · Note
• https://suse.com/security/cve/CVE-2026-31961 · Note