Fleet EUVD-2026-16754

The CVSS 4.0 base score of 6.2 reflects a moderate severity rating, with the vector indicating network-accessible attack (AV:N), low complexity (AC:L), and low privilege requirements (PR:L), but only an authenticated attacker can exploit it. The critical impact flags for confidentiality (VC:H) and integrity (VI:H) indicate successful exploitation could expose sensitive database contents. However, the moderate base score combined with the requirement for valid MDM enrollment credentials creates a significant constraint: attackers must first obtain or generate legitimate MDM enrollment certificates, which typically requires either organizational access, certificate theft, or compromise of the MDM infrastructure itself. This requirement substantially reduces real-world risk compared to unauthenticated network vulnerabilities with identical impact. EPSS data is not provided, preventing automated exploitation probability assessment. No KEV (CISA Known Exploited Vulnerability) status is indicated, meaning no confirmed active exploitation in the wild has been reported. The combination of moderate CVSS, authentication requirements, and absence of public exploit code or active exploitation suggests this is a genuine but not immediate critical priority compared to unauthenticated SQL injection vulnerabilities.

An attacker with access to a valid MDM enrollment certificate (obtained through organizational compromise, certificate theft, or insider access) authenticates to the Fleet API and submits a malicious payload within the Apple MDM profile delivery workflow. The payload is stored in the database and later processed by Fleet's backend, triggering the second-order SQL injection. The attacker can then execute arbitrary SQL queries to extract sensitive data such as user credentials, API tokens, and device enrollment secrets, potentially leading to lateral movement within the organization or compromise of additional devices under Fleet management. No public proof-of-concept code has been identified, though the attack complexity is low once the attacker possesses valid MDM enrollment credentials.