Is CVE-2026-103264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103264 being exploited in the wild.

How severe is CVE-2026-103264?

Critical severity, with a CVSS score of 9.1, published 1 October 2026.

Which products and versions are affected?

Fleet Device Management Fleet before 4.87.0.

How is CVE-2026-103264 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-103264?

Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103264: Fleet device API authentication bypass via non-secret identifiers

CVE-2026-103264 · Severity: critical · CVSS 9.1 · Published 2026-10-01

Fleet is a mobile device management and security platform that manages iOS/iPadOS and other corporate devices. The device API contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate enrolled iOS/iPadOS devices using guessable identifiers like hostnames and serial numbers. An attacker could read sensitive device data, install or uninstall software, and trigger MDM migration or policy changes without any authentication.

Technologies: Fleet Device Management Fleet. Vendors: Fleet Device Management.

Quick answers

Is CVE-2026-103264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103264 being exploited in the wild.
How severe is CVE-2026-103264?: Critical severity, with a CVSS score of 9.1, published 1 October 2026.
Which products and versions are affected?: Fleet Device Management Fleet before 4.87.0.
Is there a fix for CVE-2026-103264?: Yes: fixed in Fleet 4.87.0 and later. Until then: Until upgrading, treat iOS/iPadOS host identifiers (hostnames, serial numbers) as sensitive and limit network exposure of the Fleet server where possible. Only iOS/iPadOS hosts are affected; deployments with no iOS/iPadOS devices enrolled are not exposed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103264 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-103264?: Check whether you run Fleet Device Management Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fleet 4.87.0 and later

Until upgrading, treat iOS/iPadOS host identifiers (hostnames, serial numbers) as sensitive and limit network exposure of the Fleet server where possible. Only iOS/iPadOS hosts are affected; deployments with no iOS/iPadOS devices enrolled are not exposed.

Technical details

The device API's URL-based authentication fallback for iOS/iPadOS self-service WebClips matches the {token} path parameter against hostname, hardware serial, and device UUID columns instead of enforcing exact UUID matching. Hostnames and serial numbers are non-secret identifiers commonly exposed in asset inventories, Apple Business Manager exports, and support documentation. An unauthenticated network attacker who knows or guesses these identifiers can authenticate as a device and perform device-scoped actions including policy reads, software management, and MDM migration.

Affected products

Fleet Device Management Fleet before 4.87.0

Timeline

2026-09-15: disclosed: Advisory published on GitHub
2026-10-01: advisory: CVE-2026-103264 published
2026-09-15: patched: Fix released in Fleet 4.87.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.