SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-78587

LOW · CVSS 3.1 EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-09-02 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

Fleet Server is vulnerable due to incorrect authorization, allowing authenticated agents to disrupt ongoing upload sessions of other agents during multi-part data uploads. This could lead to a denial of service for those upload operations, impacting the overall functionality of the system. Organizations utilizing Fleet Server should prioritize addressing this vulnerability to maintain operational integrity and prevent potential service disruptions.

CVE
CVE-2026-78587
Severity
LOW
CVSS
3.1
EPSS
0.20%

Original NVD Description

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-78583 HIGH CVE-2026-78609 MEDIUM CVE-2026-78604 HIGH CVE-2026-78602 MEDIUM CVE-2026-78601 MEDIUM CVE-2026-78600 LOW