Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-103264 hits fleetdm's Fleet, CVSS 9.1. Its device API accepts hostnames and hardware serials, not just UUIDs, as authentication tokens, so an attacker who knows or guesses one can authenticate as that iOS or iPadOS device, no real credential needed. VulnTracker recommends upgrading to Fleet 4.87.0 now, this lets an attacker read device data and trigger software installs or MDM migration. #Fleet #MDM #CVE #InfoSec
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-103264 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-01 A critical vulnerability (Improper Authentication) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown
Details: https://vulntracker.io/cves/CVE-2026-103264
Fleet's device API accepted hostnames and hardware serials as authentication tokens, not just UUIDs. The fix shipped sixteen days before the CVE existed. No exploitation reported. https://severitydaily.com/fleet-cve-2026-103264-device-api-hostname-serial-tokens-ghsa-september-15/