Quick answers
- Is CVE-2026-103265 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103265 being exploited in the wild.
- How severe is CVE-2026-103265?
- Medium severity, with a CVSS score of 4.3, published 1 October 2026.
- Which products and versions are affected?
- Fleet before 4.89.0.
- Is there a fix for CVE-2026-103265?
- Yes: fixed in 4.89.0. Until then: Avoid targeting hosts from multiple teams in a single MDM command by issuing commands per-team so no command UUID spans teams. Restrict team-scoped roles to trusted users until the patch is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103265 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-103265?
- Check whether you run Fleet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.89.0
Avoid targeting hosts from multiple teams in a single MDM command by issuing commands per-team so no command UUID spans teams. Restrict team-scoped roles to trusted users until the patch is applied.
Technical details
The GET /api/latest/fleet/commands/results endpoint fails to filter MDM command result rows by team authorization when called without a host_identifier parameter. When a single MDM command UUID targets hosts across multiple teams, an authenticated user with a role limited to one team can retrieve results for all hosts sharing that command UUID regardless of team boundaries. The vulnerability requires authentication and low privileges (team observer role or higher); impact is confidentiality-only exposure of host UUIDs, command payloads, and device responses.
Affected products
- Fleet Fleet before 4.89.0
Timeline
- 2026-09-14: disclosed
- 2026-10-01: advisory