diff --git a/security/status.md b/security/status.md
index 62ae0d91e9..faafc0db67 100644
--- a/security/status.md
+++ b/security/status.md
@@ -5,6 +5,14 @@ Following is the vulnerability report of Fleet and its dependencies.
 
 ## `fleetdm/fleet` docker image
 
+### [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** There are no path-based authorization interceptors. The only interceptors are grpc_recovery (panic handlers). CVE-2026-33186 specifically requires path-based authz rules (like grpc/authz RBAC policies) that compare against info.FullMethod — Fleet doesn't use any.
+- **Products:**: `fleet`,`pkg:golang/google.golang.org/grpc`
+- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
+- **Timestamp:** 2026-03-24 12:38:53
+
 ### [CVE-2026-22184](https://nvd.nist.gov/vuln/detail/CVE-2026-22184)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
diff --git a/security/vex/fleet/CVE-2026-33186.vex.json b/security/vex/fleet/CVE-2026-33186.vex.json
new file mode 100644
index 0000000000..11c50d8526
--- /dev/null
+++ b/security/vex/fleet/CVE-2026-33186.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-26fc626bd7a7e4809e2e1c121ca89a92b091114d7ea6c561588a97d09004fd09",
+  "author": "@lucasmrod",
+  "timestamp": "2026-03-24T12:38:53.719336-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-33186"
+      },
+      "timestamp": "2026-03-24T12:38:53.719337-03:00",
+      "products": [
+        {
+          "@id": "fleet"
+        },
+        {
+          "@id": "pkg:golang/google.golang.org/grpc"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "There are no path-based authorization interceptors. The only interceptors are grpc_recovery (panic handlers). CVE-2026-33186 specifically requires path-based authz rules (like grpc/authz RBAC policies) that compare against info.FullMethod — Fleet doesn't use any.",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary"
+    }
+  ]
+}