Is CVE-2026-101047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101047 being exploited in the wild.

How severe is CVE-2026-101047?

Medium severity, with a CVSS score of 5.3, published 27 September 2026.

Which products and versions are affected?

Fleet Device Management Fleet before 4.87.0.

Is there a fix for CVE-2026-101047?

A patch was published on 2026-09-27: version 4.87.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101047 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-101047?

Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101047: Fleet missing authorization on iOS app package endpoints

CVE-2026-101047 · Severity: medium · CVSS 5.3 · Published 2026-09-27

Fleet is a device management platform used to deploy and control mobile devices in enterprise environments. In versions before 4.87.0, the enterprise tier fails to protect endpoints that serve internal iOS app packages, allowing unauthenticated attackers with network access to discover and download sensitive company applications by guessing sequential identifiers. The exposure is limited to reading app binaries and metadata; the free tier is unaffected.

Technologies: Fleet Device Management Fleet. Vendors: Fleet Device Management.

Quick answers

Is CVE-2026-101047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101047 being exploited in the wild.
How severe is CVE-2026-101047?: Medium severity, with a CVSS score of 5.3, published 27 September 2026.
Which products and versions are affected?: Fleet Device Management Fleet before 4.87.0.
Is there a fix for CVE-2026-101047?: A patch was published on 2026-09-27: version 4.87.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101047 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-101047?: Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Two unauthenticated endpoints serving in-house iOS application packages and manifests lack the intended random, time-limited token protection in versions before 4.87.0. An unauthenticated attacker on the network can enumerate and download IPA binaries and metadata (bundle ID, version, name) by guessing sequential title identifiers; session-based auth cannot be used here due to Apple MDM requirements. The vulnerability is read-only disclosure with no privilege escalation or write capability; a fix is available in version 4.87.0 and later.

Affected products

Fleet Device Management Fleet before 4.87.0

Timeline

2026-09-27: disclosed
2026-09-27: patched: version 4.87.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.