PT-2026-3750 · Jetbrains · Fleet

Prateek-0490 · Published 2026-01-20 · Updated 2026-05-14 · CVE-2026-23518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.53.3 Fleet versions 4.53.3 through 4.75.2 Fleet versions 4.75.2 through 4.76.2 Fleet versions 4.76.2 through 4.77.1 Fleet versions 4.77.1 through 4.78.3

Description A critical authentication issue exists in Fleet Device Management’s Windows MDM enrollment process. Attackers can bypass authentication by submitting unsigned or maliciously crafted JWTs. The system lacks JWT signature verification, accepting arbitrary identity claims without validating their origin from Azure AD. This allows enrollment of rogue devices under any Azure AD user identity.

Recommendations Upgrade to Fleet version 4.53.3 or later. If an immediate upgrade is not possible for versions 4.53.3 through 4.75.2, temporarily disable Windows MDM. If an immediate upgrade is not possible for versions 4.75.2 through 4.76.2, temporarily disable Windows MDM. If an immediate upgrade is not possible for versions 4.76.2 through 4.77.1, temporarily disable Windows MDM. If an immediate upgrade is not possible for versions 4.77.1 through 4.78.3, temporarily disable Windows MDM.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-23518

GHSA-63M5-974W-448V

GO-2026-4335

SUSE-SU-2026:0403-1

Affected Products

Fleet

References · 97

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23518.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-63m5-974w-448v · Vendor Advisory
• https://github.com/fleetdm/fleet/commit/e225ef57912c8f4ac8977e24b5ebe1d9fd875257 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23518 · Security Note
• https://osv.dev/vulnerability/GHSA-63m5-974w-448v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4335 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://suse.com/security/cve/CVE-2026-24124 · Note
• https://suse.com/security/cve/CVE-2026-25059 · Note
• https://suse.com/security/cve/CVE-2026-25578 · Note
• https://t.me/CVEtracker/42701 · Telegram Post
• https://twitter.com/dailycve/status/2054948988944625920 · Twitter Post
• https://suse.com/security/cve/CVE-2025-68121 · Note