Fleet EUVD-2026-30375

Requires possession of a valid enrolled Launcher node key, obtained either by compromising any managed endpoint running Fleet Launcher or through credential theft from Fleet's enrollment database. The gRPC endpoint must be network-accessible from the attacker's position (typically true for enrolled Launcher hosts communicating with Fleet server). Exploitation does NOT require privilege escalation on the Fleet server itself, administrative Fleet UI access, or specific Fleet configuration beyond default gRPC endpoint exposure. The CVSS vector PR:N conflicts with this authentication requirement-the accurate prerequisite is Launcher-level authentication (PR:L would be more appropriate). Exploitation is NOT limited by the 'Authentication Bypass' tag in metadata; that tag appears to be a tagging error as the vulnerability explicitly requires authentication and does not bypass it. Attack succeeds against default Fleet server configurations with standard Launcher enrollment enabled.

Real-world risk is moderate-high for Fleet deployments with enrolled Launcher hosts. The CVSS 8.7 score reflects maximum availability impact, but actual exploitability depends on attacker access to valid Launcher node credentials. The PR:N (No Privileges Required) in the CVSS vector conflicts with the description's 'authenticated attacker with access to any enrolled Launcher node key' requirement-this appears to be a CVSS scoring error, as enrollment credentials represent authentication. No EPSS or KEV data provided, suggesting no confirmed active exploitation at time of analysis. SSVC considerations: exploitation requires prior compromise of a Launcher host or credential theft (automatable:no), technical impact is limited to availability (partial), and the attack is straightforward once authentication is obtained (AC:L). Priority depends on Fleet's criticality to security operations-high for organizations using Fleet as primary EDR/device management, lower if redundant monitoring exists. The single-request crash makes this attractive for insider threats or lateral movement scenarios where attackers have already compromised managed endpoints. Patch availability in v4.81.0 makes this a standard upgrade priority rather than emergency, but the complete service disruption from a single request elevates urgency for internet-exposed Fleet servers with many enrolled hosts.

An attacker compromises a managed endpoint running Fleet Launcher and extracts the node enrollment key from the host filesystem or memory. Using this credential, the attacker crafts a malformed gRPC message targeting the PublishLogs endpoint with unexpected input values that trigger an unhandled exception. Upon sending this single crafted request to the Fleet server's gRPC port, the Fleet server process immediately crashes, disrupting device management and security monitoring for all enrolled hosts across the organization until administrators manually restart the service. No public exploit identified at time of analysis, but the low attack complexity suggests weaponization is straightforward for adversaries with reverse engineering capability.