PT-2026-3748 · Fleetdm+1 · Fleet Mdm+1

Prateek-0490 · Published 2026-01-20 · Updated 2026-02-18 · CVE-2026-22808

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.78.2 Fleet versions 4.53.3 through 4.77.1 Fleet versions 4.75.2 Fleet versions 4.76.2

Description Fleet, an open-source device management software, contains a cross-site scripting (XSS) flaw in its Windows MDM authentication flow. An unauthenticated attacker can exploit this issue by crafting a malicious link and tricking a Fleet user into clicking it. Successful exploitation allows the attacker to steal the user's authentication token (FLEET::auth token) from the browser's localStorage. This could grant unauthorized access to Fleet, including administrative privileges, visibility into device data, and the ability to modify configurations. In some cases, an attacker could deploy scripts to managed devices. Fleet manages millions of endpoints in enterprise environments. The vulnerability is present when Windows MDM is enabled.

Recommendations Upgrade to Fleet version 4.78.2 or later. Upgrade to Fleet version 4.77.1. Upgrade to Fleet version 4.76.2. Upgrade to Fleet version 4.75.2. If an immediate upgrade is not possible, temporarily disable Windows MDM.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22808

GHSA-GFPW-JGVR-CW4J

GO-2026-4336

SUSE-SU-2026:0403-1

Affected Products

Fleet Mdm

Windows Mdm

References · 96

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22808.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-gfpw-jgvr-cw4j · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22808 · Security Note
• https://osv.dev/vulnerability/GHSA-gfpw-jgvr-cw4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22808 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4336 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/commit/0e6c790803d1b4407c5b4b41a67a37864a3d3573 · Note
• https://suse.com/security/cve/CVE-2026-23991 · Note
• https://twitter.com/lsof/status/2014102966215516264 · Twitter Post
• https://suse.com/security/cve/CVE-2026-24740 · Note
• https://suse.com/security/cve/CVE-2026-24844 · Note
• https://suse.com/security/cve/CVE-2026-1237 · Note
• https://suse.com/security/cve/CVE-2026-23645 · Note