3.1
Low
CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via…
Description
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fleet Server 9.4 | 9.4.0 → 9.4.1 | No fix stated |
| Fleet Server 9.0 | 9.0.0 → 9.3.4 | No fix stated |
| Fleet Server 8.0 | 8.0.0 → 8.19.15 | No fix stated |
Other CVEs of Fleet Server
The 7 CVEs of Fleet Server →
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via…
6.5
Medium
CVE-2026-72676
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of…
6.5
Medium
CVE-2026-56150
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via…
6.5
Medium
CVE-2024-52975
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on…
9.0
Critical