Fleet EUVD-2026-16746

The CVSS v4.0 score of 4.9 reflects a Low severity rating with Network attack vector, Low complexity, and Low privilege requirements, but critically High integrity impact (VI:H). The CVSS vector indicates this is an authenticated attack (PR:L) with no user interaction required. While the overall CVSS score appears moderate, the integrity impact rating is significant because successful exploitation results in complete control of managed endpoints and ability to execute root-privileged commands. The real-world risk is elevated by three factors: (1) the attack requires only team maintainer privileges, a common role in multi-tenant device management deployments; (2) no user interaction is required; (3) the impact is high (endpoint compromise). However, exploitation is limited to authenticated users with at least team maintainer role, which reduces the attack surface compared to unauthenticated vulnerabilities. No active exploitation has been confirmed via CISA KEV status, and no public exploit code has been identified. This represents a legitimate but contained risk that should be prioritized based on organizational exposure to multi-team Fleet deployments.

A malicious team maintainer at Organization A discovers the host transfer API lacks proper authorization checks. They craft an API request to transfer a critical production host managed by Organization B's team into their own team. The request succeeds because the API endpoint does not validate whether the attacker has authorization over the source team. Once transferred, the attacker gains full device management control and deploys a script to the compromised host that executes with root privileges, establishing persistence or exfiltrating sensitive data. This attack requires no user interaction or social engineering and can be automated across multiple hosts.