Fleet's open source device management software exposes an XSS flaw that, when Windows MDM is enabled, allows any unauthenticated attacker to inject malicious scripts into the web interface. The attacker can then steal the administrator’s authentication token stored in the browser’s localStorage, gaining full administrative access to the Fleet instance, including visibility into device data and the ability to modify configurations. This severity is reflected by a CWE‑79 labeling of insecure input handling.

The vulnerability exists in versions prior to 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 of the fleetdm:fleet product. Those installations with Windows MDM enabled are impacted; upgrading to any of the listed patched releases eliminates the risk.

The CVSS score of 5.5 indicates moderate risk, but the EPSS score of less than 1% shows that this vulnerability is unlikely to be actively exploited at present. The attacker requires no authentication and only needs the ability to load the affected web page; therefore, the attack vector is remote via the web UI. Because the flaw only affects systems with Windows MDM enabled, administrators who have disabled that feature are not exposed. The vulnerability is not currently listed in the CISA KEV catalog, so no known large‑scale exploitation has been reported.