Fleet Software Vulnerability Opens Door to Root/SYSTEM Code Execution
CVE Notify has flagged a critical command injection vulnerability, tracked as CVE-2026-34387, within the Fleet open-source device management software. According to CVE Notify, versions prior to 4.81.1 are susceptible. The flaw resides in the software installer pipeline, specifically when an uninstall operation is triggered for a maliciously crafted software package. This could allow an attacker to execute arbitrary code with elevated privileges – root on macOS and Linux systems, or SYSTEM on Windows.
This is a pretty nasty bug. Imagine an attacker not just installing something but getting full control during a routine cleanup operation. CVE Notify points out that version 4.81.1 has been released to address this significant security gap, patching the vulnerability and closing the avenue for unauthorized code execution. The advisory highlights the potential for attackers to compromise managed hosts via this exploit, making timely patching crucial.
What This Means For You
- Immediately review and update all Fleet installations to version 4.81.1 or later to mitigate the risk of arbitrary code execution during software uninstall processes.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Suspicious File Download via Email
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-34387 | Command Injection | Fleet device management software prior to 4.81.1, software installer pipeline, arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. |
| CVE-2026-34387 | RCE | Fleet device management software prior to 4.81.1, software installer pipeline, arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. |
Related coverage
Daily Security Digest — 2026-05-22
13 vulnerability disclosures (5 Critical, 8 High) and 14 curated intelligence stories from 6 sources.
Trend Micro Apex One Zero-Day Under Active Exploitation
Trend Micro has confirmed a zero-day vulnerability in its Apex One security product, actively exploited on Windows systems. BleepingComputer reports that this critical flaw allows...
Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities
Ubiquiti has rolled out critical security updates addressing three maximum severity vulnerabilities in UniFi OS. BleepingComputer reports these flaws, tracked as CVE-2023-48092, CVE-2023-48093, and CVE-2023-48094,...