PT-2026-40967 · Fleet · Fleet

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-23998

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description A flaw in the Windows MDM management endpoint allows requests to be processed without proper client certificate validation. The endpoint relies on mutual TLS (mTLS)—a process where both the client and server authenticate each other via certificates—to authenticate enrolled devices. In affected versions, requests lacking a client certificate may be incorrectly treated as trusted. An attacker with knowledge of a valid enrolled device identifier could impersonate that device to retrieve sensitive configuration payloads, such as VPN or Wi-Fi configuration data, certificates, or other secrets delivered through MDM profiles. This issue is limited to the targeted Windows device and does not grant administrative access to the control plane or allow the enrollment of new devices.

Recommendations Update to version 4.81.0. As a temporary workaround, disable Windows MDM.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-23998

GHSA-2RC4-7JC6-QFFH

Affected Products

Fleet

References · 5

• https://osv.dev/vulnerability/GHSA-2rc4-7jc6-qffh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23998 · Security Note
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh · Note
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 · Note