CVE-2026-22808: medium-severity vulnerability in fleetdm fleet
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.2%
fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Affected products
fleetdm · fleetRelated CVEs — fleetdm fleet
In the same product, most dangerous first.
CVE-2020-26276CRITICALSAML authentication vulnerability in FleetEPSS 2.2%CVE-2021-21296LOWDenial-of-service in FleetEPSS 2.0%CVE-2026-34387MEDIUMFleet vulnerable to OS command injection via crafted software package metadata in uninstall scriptsEPSS 1.3%CVE-2022-23600MEDIUMLimited ability to spoof SAML authentication with missing audience verificationEPSS 0.9%CVE-2022-24841MEDIUMImproper Authorization in github.com/fleetdm/fleetEPSS 0.8%CVE-2026-26191MEDIUMFleet vulnerable to OS command injection in software packagesEPSS 0.8%