Fleet EUVD-2026-16799

This vulnerability presents significant real-world risk despite the absence of a CVSS vector. The exploitation is fundamentally straightforward: any compromised or malicious device already enrolled in the MDM system can exploit the authorization flaw without requiring additional privileges or complex attack techniques. The attack vector is local-to-network (device-to-management-server), placing it within reach of any compromised endpoint or insider threat. The impact is high-integrity information disclosure affecting all Windows devices in the fleet simultaneously, exposing WiFi credentials, VPN secrets, and certificate payloads that could enable lateral movement, network compromise, or further attacks. No public exploit code or active exploitation (KEV status) has been reported at the time of analysis, but the simplicity of the attack-coupled with the sensitivity of exposed credentials-makes this a critical priority for any organization running Fleet prior to version 4.81.1. The fact that a vendor patch exists and is already released significantly reduces the practical risk for patched deployments.

An attacker with control over a Windows device enrolled in a Fleet MDM infrastructure (through compromise, insider access, or supply-chain manipulation) could exploit the authorization flaw by querying the MDM command processing endpoint for commands intended for other devices. The attacker would receive sensitive payloads including WiFi network credentials, VPN connection secrets, and certificate data meant for distribution to other endpoints, enabling the attacker to access corporate networks, intercept encrypted traffic, or impersonate legitimate devices. No public exploit code has been identified at the time of analysis, but the straightforward nature of authorization bypass vulnerabilities suggests exploitation is feasible without significant technical sophistication.