CVE-2026-23999

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23999", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.658Z", "datePublished": "2026-02-26T02:45:48.099Z", "dateUpdated": "2026-02-26T15:15:55.289Z"}, "containers": {"cna": {"title": "Fleet: Device lock PIN can be predicted if lock time is known", "problemTypes": [{"descriptions": [{"cweId": "CWE-330", "lang": "en", "description": "CWE-330: Use of Insufficiently Random Values", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 0.6, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w"}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"version": "< 4.80.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:45:48.099Z"}, "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if the approximate time the device was locked is known. Fleet\u2019s device lock and wipe commands generate a 6-digit PIN that is displayed to administrators for unlocking a device. In affected versions, this PIN was deterministically derived from the current timestamp. An attacker with physical possession of a locked device and knowledge of the approximate time the lock command was issued could theoretically predict the correct PIN within a limited search window. However, successful exploitation is constrained by multiple factors: Physical access to the device is required, the approximate lock time must be known, the operating system enforces rate limiting on PIN entry attempts, attempts would need to be spread over, and device wipe operations would typically complete before sufficient attempts could be made. As a result, this issue does not allow remote exploitation, fleet-wide compromise, or bypass of Fleet authentication controls. Version 4.80.1 contains a patch. No known workarounds are available."}], "source": {"advisory": "GHSA-ppwx-5jq7-px2w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:15:42.627648Z", "id": "CVE-2026-23999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:15:55.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:15:42.627648Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:15:49.832Z"}}], "cna": {"title": "Fleet: Device lock PIN can be predicted if lock time is known", "source": {"advisory": "GHSA-ppwx-5jq7-px2w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 0.6, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"status": "affected", "version": "< 4.80.1"}]}], "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w", "name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if the approximate time the device was locked is known. Fleet\u2019s device lock and wipe commands generate a 6-digit PIN that is displayed to administrators for unlocking a device. In affected versions, this PIN was deterministically derived from the current timestamp. An attacker with physical possession of a locked device and knowledge of the approximate time the lock command was issued could theoretically predict the correct PIN within a limited search window. However, successful exploitation is constrained by multiple factors: Physical access to the device is required, the approximate lock time must be known, the operating system enforces rate limiting on PIN entry attempts, attempts would need to be spread over, and device wipe operations would typically complete before sufficient attempts could be made. As a result, this issue does not allow remote exploitation, fleet-wide compromise, or bypass of Fleet authentication controls. Version 4.80.1 contains a patch. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-330", "description": "CWE-330: Use of Insufficiently Random Values"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:45:48.099Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23999", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:15:55.289Z", "dateReserved": "2026-01-19T18:49:20.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T02:45:48.099Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": "< 4.80.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1490125-39FE-4B90-AC5F-62B26ED3C509", "versionEndExcluding": "4.80.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if the approximate time the device was locked is known. Fleet\u2019s device lock and wipe commands generate a 6-digit PIN that is displayed to administrators for unlocking a device. In affected versions, this PIN was deterministically derived from the current timestamp. An attacker with physical possession of a locked device and knowledge of the approximate time the lock command was issued could theoretically predict the correct PIN within a limited search window. However, successful exploitation is constrained by multiple factors: Physical access to the device is required, the approximate lock time must be known, the operating system enforces rate limiting on PIN entry attempts, attempts would need to be spread over, and device wipe operations would typically complete before sufficient attempts could be made. As a result, this issue does not allow remote exploitation, fleet-wide compromise, or bypass of Fleet authentication controls. Version 4.80.1 contains a patch. No known workarounds are available."}, {"lang": "es", "value": "Fleet es un software de gesti\u00f3n de dispositivos de c\u00f3digo abierto. En versiones anteriores a la 4.80.1, Fleet generaba PINs de bloqueo y borrado de dispositivos utilizando un algoritmo predecible basado \u00fanicamente en la marca de tiempo Unix actual. Debido a que no se utilizaba ninguna clave secreta o entrop\u00eda adicional, el PIN resultante podr\u00eda derivarse potencialmente si se conoce la hora aproximada en que se bloque\u00f3 el dispositivo. Los comandos de bloqueo y borrado de dispositivos de Fleet generan un PIN de 6 d\u00edgitos que se muestra a los administradores para desbloquear un dispositivo. En las versiones afectadas, este PIN se derivaba de forma determinista de la marca de tiempo actual. Un atacante con posesi\u00f3n f\u00edsica de un dispositivo bloqueado y conocimiento de la hora aproximada en que se emiti\u00f3 el comando de bloqueo podr\u00eda, te\u00f3ricamente, predecir el PIN correcto dentro de una ventana de b\u00fasqueda limitada. Sin embargo, la explotaci\u00f3n exitosa est\u00e1 limitada por m\u00faltiples factores: Se requiere acceso f\u00edsico al dispositivo, se debe conocer la hora aproximada de bloqueo, el sistema operativo impone l\u00edmites de velocidad en los intentos de entrada del PIN, los intentos tendr\u00edan que distribuirse, y las operaciones de borrado del dispositivo normalmente se completar\u00edan antes de que se pudieran realizar suficientes intentos. Como resultado, este problema no permite la explotaci\u00f3n remota, el compromiso de toda la flota o la elusi\u00f3n de los controles de autenticaci\u00f3n de Fleet. La versi\u00f3n 4.80.1 contiene un parche. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-23999", "lastModified": "2026-06-17T10:22:27.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.6, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23999", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:15:42.627648Z", "version": "2.0.3"}}]}, "published": "2026-02-26T03:16:04.010", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.80.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "fleet", "source": "cna", "vendor": "fleetdm"}, "product": "fleet", "vendor": "fleetdm"}], "analysis": {"en": {"generated_at": "2026-04-17T14:26:34.304146+00:00", "value": {"mitigation_remediation": ["Upgrade Fleet to version 4.80.1 or later to apply the patch that uses a secure, non\u2011predictable PIN generation mechanism.", "If device lock functionality is not essential, disable it to eliminate the risk of PIN prediction.", "Enforce strict physical security controls for devices to prevent unauthorized access, and monitor for repeated PIN entry attempts or other abnormal access patterns."], "summary": {"action": "Patch Immediately", "impact": "Predictable 6-digit PIN for device lock"}, "threat_synthesis": {"affected_systems": "The affected product is Fleet, the open\u2011source device management platform from fleetdm. All versions earlier than 4.80.1 are vulnerable; version 4.80.1 and later contain the fix.", "description_and_impact": "Fleet generates a 6\u2011digit PIN for device lock and wipe using only the current Unix timestamp, with no secret key or additional randomness. The PIN is displayed to administrators and used to unlock the device. Because the algorithm is deterministic, an adversary who knows the approximate time a lock command was issued and has physical access to the device could predict the PIN within a limited search window, potentially bypassing the lock. However, the vulnerability does not allow remote exploitation, fleet\u2011wide compromise, or compromise of Fleet\u2019s authentication controls.", "risk_and_exploitability": "The CVSS score of 0.6 and an EPSS score of less than one percent indicate a low severity and very limited likelihood of exploitation. The vulnerability requires physical possession of the device, knowledge of the lock time, and the ability to enter PIN guesses before rate limiting or wipe completion prevents further attempts. The issue is not listed in CISA\u2019s KEV catalog."}}}}, "created": "2026-02-26T13:09:43.750854+00:00", "updated": "2026-04-17T14:30:20.829116+00:00", "vendors": ["fleetdm", "fleetdm$PRODUCT$fleet"]}