Fleet EUVD-2026-16756

The CVSS v4.0 score of 6.3 reflects a medium severity rating driven by high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) but mitigated by the authentication requirement (PR:L). The network vector (AV:N) and low complexity (AC:L) indicate ease of exploitation once credentials are obtained. However, the requirement for Team Admin or Global Admin privileges significantly limits the real-world attack surface compared to unauthenticated vulnerabilities. No KEV status, active exploitation confirmation, or public proof-of-concept availability is indicated in the provided data. The exploit is automatable once authentication is achieved, but the need for elevated administrative privileges makes opportunistic exploitation unlikely in most deployments. Organizations should prioritize patching based on their internal admin account security posture and whether they permit admin credential sharing or temporary elevation scenarios.

A disgruntled Team Admin with legitimate access to the Fleet API crafts a malicious MDM bootstrap package configuration containing SQL injection payloads targeting the team configuration endpoint. The attacker injects a UNION-based SQL injection payload that exfiltrates the usernames and password hashes of other administrator accounts from the database, or modifies an existing team's device compliance policies to disable security enforcement across enrolled devices. Alternatively, an external attacker who obtains Team Admin credentials through phishing or password reuse exploits this vulnerability to query sensitive MDM device data or modify configurations across multiple teams without leaving obvious audit trails.