CVE-2026-101047

What it is

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-27 18:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-07 17:27 UTC Last updatedMost recent change to the record

Details

Published

2026-09-27 18:16 UTC

Last modified

2026-10-07 17:27 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Analyzed

Affected

• Fleetdm Fleet < 4.87.0

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None