Fleet Device Management: Authentication bypass via device identifiers
Summary
Fleet versions before 4.87.0 accept hostnames and hardware serial numbers as authentication tokens for the device API, in addition to device UUIDs. An unauthenticated attacker who knows or guesses such an identifier for an enrolled iOS or iPadOS host can act as that host. This allows reading device data and triggering device-scoped actions such as software installation and MDM migration. Only deployments with enrolled iOS or iPadOS hosts are affected.
Affected
- Fleet versions before 4.87.0
- Only iOS and iPadOS hosts are affected
Fixed in
- Fleet 4.87.0 and later, which restricts this authentication path to an exact match on the device UUID
Workaround
- No complete workaround is documented. Upgrading is required.
- Until the upgrade, treat hostnames and serial numbers of iOS and iPadOS hosts as sensitive and limit network exposure of the Fleet server.
Exploitation
- No exploitation in the wild is known. CISA SSVC lists exploitation as none, and automatable as yes.
- Public proof-of-concept exploit code: unknown.
Our recommendation
- Confirm the Fleet version and whether the Fleet server is reachable from the internet.
- Upgrade to Fleet 4.87.0 or a later release as soon as possible. Internet-facing servers have priority.
- Review audit logs for unexpected device API requests, software installations and MDM migrations on iOS and iPadOS hosts.
- Restrict network access to the device API where operationally possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vrc8-2wcx-327f github.com
- VulnCheck advisory: Fleet before 4.87.0 authentication bypass www.vulncheck.com
- OSV entry CVE-2026-103264 osv.dev
- OpenCVE entry CVE-2026-103264 app.opencve.io
- Fleet security overview github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:41.
Original description (NVD)
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.