Fleet EUVD-2026-16758

The CVSS v4.0 score of 5.7 reflects a moderate severity profile with several mitigating factors that reduce real-world exploitability compared to typical RCE vulnerabilities. The attack vector is network-based (AV:N) and requires low attack complexity (AC:L), but critically demands high privileges (PR:H), meaning the attacker must already possess administrative or management console access to Fleet. Additionally, user interaction (UI:A) is required-an administrator must actively trigger the uninstall operation on the crafted package. The CVSS vector shows very high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), confirming the severity of successful exploitation. However, the combination of required high privileges, mandatory user action, and network attack surface significantly constrains real-world risk compared to unauthenticated remote exploits. EPSS exploitation probability is not provided in the available intelligence. The absence of KEV status (CISA Known Exploited Vulnerabilities) and publicly available proof-of-concept code further indicates this is not actively weaponized. This should be prioritized as a high-priority patch for organizations deploying Fleet, but it is not a critical emergency-the high privilege requirement effectively limits the threat actor population to insiders or those who have already compromised administrative credentials.

A malicious insider or external attacker who has gained compromise of a Fleet administrator account crafts a software package with specially-formatted metadata containing shell metacharacters (e.g., backticks, command separators, or variable injection) in fields that are processed during uninstall operations. When a legitimate administrator initiates the uninstall of this malicious package across a set of managed macOS or Linux endpoints, the injected command is executed with root privileges on each target host, allowing the attacker to install persistence mechanisms, exfiltrate sensitive data, or move laterally within the network. No public proof-of-concept code has been identified, but the attack complexity is low once administrative access is obtained, making this a credible threat in environments with weak credential security or insider threats.