Which versions of Fleet are affected by EUVD-2026-90658?

Fleet, the device management platform used to administer the organization's iOS and iPadOS fleet, has an authentication-bypass flaw in all versions before 4.87.0 that lets an attacker impersonate…. A patch is available.

How to fix or mitigate EUVD-2026-90658?

Within 24 hours, inventory all Fleet deployments and confirm which instances are running versions earlier than 4.87.0; reduce exposure by placing the Fleet server behind restricted network access and limiting management API reachability to trusted networks and administrative hosts. Within 7 days, upgrade every affected instance to Fleet 4.87.0 (Vendor-released patch: 4.87.0), prioritizing internet-facing or broadly reachable servers first, then validate the upgrade by confirming the reported version and re-testing device enrollment. Within 30 days, rotate any device identifiers or enrollment secrets that may have been exposed, review Fleet audit and activity logs for unexpected device-scoped actions or MDM migration events, confirm that no unauthorized software installations or management server changes occurred, and fold Fleet version currency into routine patch-management reporting to prevent recurrence. Note that no public exploit code has been identified at time of analysis; per available CVSS data the flaw is rated 9.3 (CRITICAL).

Fleet EUVD-2026-90658

Q: What is the CVSS score of EUVD-2026-90658?

EUVD-2026-90658 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-103264 CRITICAL

Improper Authentication (CWE-287)

2026-10-01 VulnCheck

GHSA-rmfg-c7hm-wv58

Authentication Bypass Apple Fleet Fleetdm

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote unauthenticated API call with non-secret identifier (AV:N/AC:L/PR:N/UI:N); high confidentiality (device data) and integrity (software install/MDM migration), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Oct 01, 2026 - 15:24 vuln.today

Analysis Generated

Oct 01, 2026 - 11:25 vuln.today

Patch available

Oct 01, 2026 - 11:01 EUVD

CVE Published

Oct 01, 2026 - 10:42 cve.org

CRITICAL 9.3

DescriptionCVE.org

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

AnalysisAI

Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation targets Fleet device management deployments (versions before 4.87.0) that have iOS/iPadOS hosts enrolled and expose the device API, which by default accepts hostnames and hardware serials as authentication tokens alongside the intended secret device UUID. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue, not a CVSS-inflated one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Fleet 4.87.0 or later to fix this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Fleet deployments and confirm which instances are running versions earlier than 4.87.0; reduce exposure by placing the Fleet server behind restricted network access and limiting management API reachability to trusted networks and administrative hosts. …

Threat intelligence, references, and detailed analysis are available after sign-in.