diff --git a/security/status.md b/security/status.md
index b7a5e330e1..567cf68e42 100644
--- a/security/status.md
+++ b/security/status.md
@@ -132,6 +132,22 @@ Following is the vulnerability report of Fleet and its dependencies.
 
 ## `fleetdm/fleetctl` docker image
 
+### [GHSA-72hv-8253-57qq](https://nvd.nist.gov/vuln/detail/GHSA-72hv-8253-57qq)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** Vulnerability only affects Java/JVM web applications that use Jackson's asynchronous (non-blocking) JSON parser.
+- **Products:**: `fleetctl`,`pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-03-13 12:30:33
+
+### [CVE-2026-27465](https://nvd.nist.gov/vuln/detail/CVE-2026-27465)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** This is a vulnerability in Fleet, not fleetctl.
+- **Products:**: `fleetctl`,`pkg:golang/github.com/fleetdm/fleet/v4`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-03-13 12:33:34
+
 ### [CVE-2026-24515](https://nvd.nist.gov/vuln/detail/CVE-2026-24515)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
diff --git a/security/vex/fleetctl/CVE-2026-27465.vex.json b/security/vex/fleetctl/CVE-2026-27465.vex.json
new file mode 100644
index 0000000000..6fcba43fba
--- /dev/null
+++ b/security/vex/fleetctl/CVE-2026-27465.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-ff7adeaed9887d70ba7d35e6abc59bd7f9ede62e3b45bd5c2394900febff6aa3",
+  "author": "@lucasmrod",
+  "timestamp": "2026-03-13T12:33:34.509016-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-27465"
+      },
+      "timestamp": "2026-03-13T12:33:34.509017-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:golang/github.com/fleetdm/fleet/v4"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "This is a vulnerability in Fleet, not fleetctl",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
diff --git a/security/vex/fleetctl/GHSA-72hv-8253-57qq.vex.json b/security/vex/fleetctl/GHSA-72hv-8253-57qq.vex.json
new file mode 100644
index 0000000000..5c79c27817
--- /dev/null
+++ b/security/vex/fleetctl/GHSA-72hv-8253-57qq.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-147152e5526205759cd1f30c116079bbce176be2d6b7c31b09ff9ce21d2c68ec",
+  "author": "@lucasmrod",
+  "timestamp": "2026-03-13T12:30:33.367195-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "GHSA-72hv-8253-57qq"
+      },
+      "timestamp": "2026-03-13T12:30:33.367196-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "Vulnerability only affects Java/JVM web applications that use Jackson's asynchronous (non-blocking) JSON parser",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}