Fleet EUVD-2026-16795

Although CVSS scoring data is unavailable, this vulnerability presents significant real-world risk due to its impact scope. The required authentication (authenticated host) narrows the attack surface to established agents or compromised endpoints already enrolled in Fleet; however, once authenticated, the attacker can unilaterally crash infrastructure serving potentially thousands of managed devices. The availability impact is critical-a single authenticated host can disable MDM management, disrupt API operations, and require manual server restart, making this a practical denial-of-service weapon in post-compromise scenarios or environments with weak host security. The attack complexity is trivial (sending a single malformed message), and exploitation requires no special network positioning. This is a high-priority patch despite missing CVSS data because of the ease of exploitation and broad blast radius affecting infrastructure operations, not just a single host.

An attacker with an enrolled Fleet agent (authenticated host) or compromised endpoint sends a crafted gRPC message to the Launcher endpoint containing an invalid log type value outside the expected enumeration. The Fleet server fails to validate or catch this exception, causing the process to crash immediately and terminating all active connections to the MDM infrastructure. While the scenario requires prior host enrollment or compromise, the trivial nature of crafting a malformed gRPC message means exploitation could occur within seconds of gaining authenticated access, making this a critical post-compromise capability.